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>rograrn to control a robot manipulator for industrial assembly operations must 

)unt possible errors in parts placement and tolerances of the parts themselves. 

roaches to this problem have been to (1) engineer the situation so that the 

all or (2) let the programmer analyze the errors and take explicit account 

is paper gives the mathematical underpinnings for building programs [plan 

carry out approach (2) automatically. The plan checker uses a geometric 

tabase to infer the elTects of actions and the propagation of errors. It does 

lly rather than numerically, so that computations can be reversed and desired 

ranees can be used to infer required initial tolerances or the necessity for 

checker modifies plans to include sensing and adds constraints to the plan 

that it will succeed. An implemented system is described and results of its 

! presented. The plan checker could be used as part of an automatic planning 

an aid to a human robot programmer. 



ments. This report describes research done at the Artificial Intelligence 

)f the Massachusetts Institute of Technology. Stipport for the Laboratory's 

elligence research is provided in part by the Office of Naval Research un- 

Naval Research contract N00014-81--K-0494 and in part by the Advanced 

ects Agency under Office of Naval Research contract N00014- 80~C- 0505. 
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R( bot systems considered in this paper consist of three agents. A robot controller, 
thecl^ er and a combined robot controller and robot manipulator. 
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1. Introduction 

p£ Der presents a method for checking and modifying robot plans to ensure that 

11 W( rk given mechanical errors in placement and orientation of workpieces, and 

of to erances in the construction of the workpieces themselves. The paper goes on 

St h )W the same method might be used to generate complex robot plans in the first 



plan is a program for a robot controller. It describes the motions to be made 
and the sense operations to carried out. It is a computer program and includes 
iditional on sense operations. 

tic generation of plans for robots is a rich field of research that has many 
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TH^ terili robot planner is used to refer to an agent planning to use a robot manipulator 
s 'me task. A robot planner may either be a person planning the actions to be 
but b ^ a robot, or an intelligent program performing the same task. Even for people, 
lite difficult and it is worthwhile building automatic aids. 



This pa )er provides the underpinnings for building programs that can automatically 

check ithethtr a plan generated by a robot planner is feasible, i.e. whether it is applicable 

and uiilier wfiat circumstances it will achieve the goals set by the robot planner. Such pro- 

ftre c^led pian checkers. In addition, plan checkers can at times provide information 

to fi| a plan to ensure that it will work. 
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lems. Very few attempts have been made to build programs which completely 
cally generate a robot plan, then command the robot to actually carry it out. 
ions some previous attempts and their successes and shortcomings. Most 
out by today's robots, even in centers of Artificial Intelligence research, are 



plan has been checked, a robot controller executes the plan, using a robot 
and sensors to interact with the physical world. The plan checker must reason 
pabilities of the robot controller in order to check and modify plans for the 
s that the controller will make in interpreting sensor readings. 



implementations of robot systems the distinctions between the three agents, 
, chJcker and controller, will be much fuzzier than shown in figure 1. 



nties. 



r 



le 



thrust of this work is in ensuring that a plan will succeed in spite of uncer- 
physical world whose values can not be exactly determined at the time the 
ulated. Tlicre are three major sources of uncertainties. 
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ipuhitorB are complex mechanical devices. There are upper bounds on speed 
and limits to accuracy and repeatability. The abs^olute positional accuracy of 
is the error in that results when it is instructed to position its end effector 
position and orientation in space. This may depend on temperature, load, 
ement and the particular position within its work area. Furthermore, in a 
re these parameters are all fixed, a manipulator will not in general return to 
same location and orientation when commanded to repeat an operation over 
) error measures the positional repeatability. There can be contributions from 
s, and from long term drift effects which can be corrected by calibration, 
and repeatabihty errors of current manipulators are sufliciently large to 
ns in carrying out a large class of planned tasks in the absence of feedback 
xecution. Manipulators can be made more accurate by machining their parts 
ely and using more resilient materials. There is however a tradeoff between 
"ormance of manipulators, so that there is a point of diminishing returns in 
d ever more accurate mechanisms. 



iiiake natters worse for the robot planner, multiple copies of a mechanical part are 

i<lienti( al in all their dimensions. It is impossible to manufacture parts with exact 

on . Instead, designers specify tolerances for lengths, diameters, and angles. 

ade rom the design can take on any physical values for the parameters which fall 

.he c ^signed tolerances. The effects of the.se variations might be large enough by 

ves 1 1 be a significant factor in the success or failure of a planned robot manipulator 

When many parts are assembled into a whole, the individual small variations can 

and become large. 



Ofifen th i most significant source of uncertainty is the position and orientation of a 

-\4ien it is first introduced into the task. Mechanical feeders sometimes deliver 

^th IJrge uncertainties in position and orientation, sometimcB on the order of 50% 

the part. Conveyor belts deliver parts with even larger uncertainties, A robot 

ofteli includes actions in the plan that are aimed at significantly reducing these 

Wmceitainties. The methods described in this paper can be used to analyze those 
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Tik thelrie of this paper is that while uncertain situations are hard to compute with 
directlVIl it h possible to make inferences about uncertainties and compute with those 
inferences 

1.2 Pla :i8. 
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>r a robot to carry out a task must take into account these three sources of 
it is to be guaranteed to succeed. There are two standard responses to the 
ncertainties. One is to ignore them, based on the assumption that they are 
ffect the success of the plan based on nominal values. (Significant engineering 
ry to ensure the validity of such an assumption, e.g. the construction of jigs 
A. second is to estimate the uncertainties, compute the effects of uncertainties, 
ide if they are too large for the plan to work. This paper offers a third 
consists of computing the effects of the uncertainties symbolically. If they 
ugh, the plan can be accepted. Otherwise the most significant uncertainties 
icd, and the plan can then either be constrained to succeed in spite of them, 
be identified to reduce those uncertainties, or the plan can be modified to use 
proach which can succeed. 

out the paper uncertainty is used rather than error. This is intended to stress 
ans can take into account what are traditionally called errors, and deal with 
ner which ensures that the plans will succeed. 



1963) introduced the notion of hierarchically decomposing a plan into sub- 
pianning islands. A plan is split up into a linear sequence of smaller subplans 
2. Each level is more detailed. The levels are often called loveh of abstraction. 
^f planning then consists of making a top-level plan less and less abstract by 

it into subplans, and filling in details at the lower levels. 
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s can be doconiposed hierarchically into subplans. Any particular subplan, 
:an be abstractly viewed as a complete plan to get from the state left by its 
to the state desired by its right neighbor. 



re various constraints that link the more detailed subplans together. For 
ubplan A is followed immediately by subplan B, then at entry to subplan 
planner assumes the state of the world to be that upon exit from subplan A, 
bplan imposes constraints on subplans that follow. Dually, a subplan inherits 
onstralints f-om proceeding subplans. 



stage of a planning process there may be many decisions that have been 
1 later constraints generated by the planning process have been checked (this is 
ferred to as posting constraints, e.g. Sacordoti (1977), Stefik (1981)). There is 
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a^ant nge to making a decision until absolutely necessary. Instead, facts that affect 
ould be collected along the way and the decision should be made only when 
Eventually the combined effects of the facts affecting a decision have been 

^ped Ind it simply remains to make all of the outstanding decisions while satisfying 
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any level of abstraction a plan consists of specifications of the initial and final 
vith an action to effect the transition. 



su jplan can be considered at some level of abstraction to conform to the scheme 
'here is a class of possible initial states of the world (which should include all 
meet the conditions imposed by the previous subplan in the chain). There is 

pcfesible final states of the world. The action is a mapping from initial states to 
The possible final states should be a subset of the initial states which can be 
handled by he following subplan. 



Ff|ure 1 shows a plan that has been modified to include some sensing operations. The 
rlbot controller is now clear. It must interpret the sensory data and relate it to 
paran^^ers If the planned action. 

7 



Thiis a itbot planner must maintain two models. One is a model of the world. The 
other a b mcliel of the state of knowledge of the robot controller (which will perhaps be 
itself) t\i\ the time the plan is being executed. The robot planner must reason about the 
interpret atioi capabilities of the robot controller, in terms of the knowledge it will have 
from sensory data and its knowledge retained from previous plan steps. 
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med for simplicity that a plan generated by the robot planner corresponds 
'he plan may include sensing operations but they may be considered to be 
black box of the initial state. The plan checker need only concern itself with 
tions that it suggested. In reality, the robot planner and plan checker may 
integrated, or even indistinguishable. The essence of the model presented 
less remains valid in that context. 



oach to plan checking presented here makes no particular commitment to the 
ing used to generate the plans originally. In fact section 6.2 discusses ways 
vo dilTcrent planing systems working on the same problem. The mathematics 
s of plans arc more central concerns. 



ans. 



plan checker is checking a subplan, there are a number of possible outcomes. 
C six are considered here. 



; It can accept the plan as workable, perhaps adding further constraints. 

: It can add sensing operations to provide more accurate execution-time 
the robot controller, to ensure that the plan will work. 



It can change the pre-conditions it requires from previous subplans in order 
the plan works. 
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It. can reject the plan if it determines that there are no sensing operations 
are powerful enough to guarantee that the action will be applicable. 



: It can reject the plan if it is deemed geometrically infeasible independent of 
e uncertainties in the physical system can be reduced by sensing operations. 



Tti|^ alglrithm presented later in this paper has five of these six possible outcomes. In 
ti a m ithematical model is developed which provides a framework for designing such 
g ven any suitable mechanism for inference on constraints. 
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1.4 Outl ne oithe Paper. 

r approaches plan checking in three ways. 

resents two examples of the use of symbolic algebra and reasoning to analyze 
n physical situations. 



1. Sectic n 2 \ 
uncertai ities 



ThJ4l firsi example is a single step in a plan presented in full detail. The algebraic 

expressions i; volved have the complexity that can be expected in realistic plan checking 

A is (Jue to Taylor (1976). He estimated errors in an assembly task by propagat- 

errors forward through a geometric model of a physical situation. In this 

, symbolic expressions are computed and propagated. Once the algebraic 

■e set up, it is possible to use them in several ways. First following Taylor, the 

lints can be fixed and the results computed. Second, the desired results can 

he constraints those results imply for the initial situation can be computed. 
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Tli^ sec( nd example is a simplified version of an assembly operation carried out by 

d^lbul and Evans (1976) have a scries of photographs). It includes the interactions 

)lan slands and is intended to demonstrate realistic interactions which can occur 

step in a plan. The algebraic expressions are perhaps simpler than might be found 

re re listic plan. Section 2 introduces the example which is then used throughout 

to ri otivate and exemplify the theoretical constructs. It is simplified to bring out 

ispects of the plan checking algorithm in such a way that the symbolic algebra 

ollovled without the aid of a computer. 



develops a formal model of plans. In addition it shows how sensing opera- 
le structure of a plan. Section 4 then examines the formal mathematics of 

nts -slithin this framework, and identifies the properties of mathematical quantities 
th a plan which can be used to check the validity of the plan, suggest sensing 

ns, i ad propagate constraints forwards and backwards between planning islands. 

10 



3. Sectildin 
terms o 
exists 
precisel 



t<: 



Fin illy 
problenr 3 an( 



5 1 
cert 
con 

the 



istantiates the formal model of a plan checker developed in sections 3 and 4 in 
tin computable properties of non- linear algebraic inequalities. An algorithm 
pute these properties. The instantiated plan checker is able to carry out 
:omputations developed in the example of section 2. 

ection 6 relates this work to previous work on planning, and points out 
areas for further development. 
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2, Some Examples 

ex£ n^iples of plan checking are given in this section. The first example shows 
features of the plan checking algorithm on a realistic single plan island. It 
the basic idea of propagating desired results backwards through tolerance 
ity computations. The second example uses simplified geometry but shows 
g plan islands. Only its structure is introduced in this section, along with a 
results of running an implemented plan checker over it. It demonstrates how 
r can choose the best place to introduce sensing into a sequence of operations, 
in resolve plan decisions which may not be intuitively obvious. The example 
in more detail in section 5 to illustrate the behavior of an implemented plan 
rithm. The appendix shows the complete specification of the four plans as 
mplemented plan checker. 



of 

:|c an< 

N 



2.1 A |4^alis|ically Complex Example. 

TMs sociion illustrates a plan checker symbolically analyzing the uncertainties involved 

pie nsertion task. The example is taken from Taylor (1976). It contrasts the 

propagating numeric errors with the methods described later in this paper for 

lysis of uncertainties. The computations for this example were carried out by 

fM model- based vision system, described in in Brooks (1981a) and in more 

Brc [^ks (1981b). 



is a close up view of a model of the situation described in example 2 of 
of Taylor (1976). 

a box with four holes in its top sitting on a table with a given position and 
bout the vertical axis. The position and orientation are subject to known 
. A manipulator hand holding a screwdriver, with a screw at the end, is placed 

the holes. It has three degrees of position uncertainty, and three degrees of 
ncertainty. In addition the screw has two degrees of rotational freedom in its 
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box rests upon a table with an uncertain position and orientation. A 
land with uncertain position and orientation grasps a screwdriver to which a 
atta :hed with two rotational degrees of freedom. 



ator 



f lor \ 
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attachriient t) the screwdriver. It can wobble backwards and forwards about two orthogonal 
axes w Ifch g|) through the center of the end of the screwdriver shaft. If all the uncertainties 
in posif. on ajd orientation are zero then the tip of the screw should be exactly in the center 
of the lllole oti the box. 



sed the following constraints on the errors. The variable names are mnemonics 

to which they refer. 

—0.3 < BOX-DELTA~POS-X < 0.3 

—0.2 < BOX-DELTA~r»OS-Y < 0.2 

—5° < BOX-DELTA'ORI < 5^ 

—0.05 < HAND-DELTA-POS-X < 0.05 

—0.05 < HAND-DELTA-POS-y < 0.05 

—0.25° < HAND-WOBBLE-X < 0.25° 

—0.25° < HAND-WOBBLE-Y < 0.25° 

—0.25° < HAND-WOBBLE-Z < 0.25° 

—5° < SCREW~WOBBLE~Y < 5^ 

—5° < SCREW~W0BBLE~2 < 5^ 
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rr 3d a screwdriver of length DRIVER-LENGTH that was exactly 10 inches. A fixed 
was also assumed. 



t le 



as interested in predicting the uncertainty that could be tolerated in the 

tip of the screw relative to the center of the hole. This can be done by 

1 the coordinate transforms relating the parts of the model to get a symbolic 

the coordinates of the screw tip in the coordinate system of the hole. The 

ti|insforras can then be multiplied out symbolically (provided suitable algebraic 

can be done - see Brooks (1981a)) to get expressions for the three coordinates. 

these coordinates would be (0,0,0). The ranges of possible values for 

rdinates indicate the position errors in the placement of the screw tip. The 

expression so obtained for the error in the y-coordinate. 



le 
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1.260 — 1.516 X 8in(B0X-DELTA-0Rl) 

1.25 X sin(HAND-WOBBLE~Y) X sin(SCREW~WOBBLE~Z) X sin(~HAND-WOBBLE-X) 

X 8in(B0X-DELTA-0RI -f HAND-WOBBLE- Z) 
BOX-DELTA-POS-Y X cos(BOX-DELTA~ORl) 
HAND~DELTA-POS-X X sin(BOX-DELTA-ORl) 
1.25 X cos(HAND~WOBBLE~Y) X cos(SCREW-WOBBLE-Z) X sin(SCREW-WOBBLE-Y) 

X sin(BOX-DELTA-ORI -f HAND-WOBBLE-Z) 
1.25 X COS(SCREW-WOBBLE~Y) X COs(SCREW-WOBBLE-Z) 

X cos(— HAND-WOBBLE-X) X sin(HAND-WOBBLE-<Y) 

X, Bin(BOX-DELTA-ORI -f HAND-WOBBLE-Z) 
1.25 X C08( SCREW-WOBBLE" Y) X Cos(SCREW-WOBBLE-Z) 

X cOs(B0X-DELTA~0RI + HAND-WOBBLE-Z) X sin(~HAND-WOBBLE-X) 
1.25 X C08(~HAND-WOBBLE-X) X COs(B0X-DELTA-0RI -f HAND-WOBBLE-Z) 

X sin(SCREW-WOBBLE-z) 
1.260 X cos(B0X~DELTA-0RI) 
BOX-DELTA-POS-X X 8in(B0X-DELTA-0Rl) 
DRIVER'LENGTH X co8(~HAND-W0BBLE-X) X sin(HAND~WOBBLE-Y) 

X sin(BOX-DELTA"ORI + HAND-WOBBLE-z) 
DRIVER-LENGTH X co8(B0X~DELTA-0RI ~f HAND-WOBBLE- Z) 

X 8in(~-HAND-W0BBLE-X) 
HAND-DELTA-POS-Y X COS(BQX-DELTA-ORI) 
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Tli^ 8ynn|)olic expression bounding algorithms described in Brooks (1981a) were applied 
to the tltiree loordinate expressions, given the above error bounds. The results were: 

—0.0607 < Ax < 0.0510 

—0.590 < Ay < 0.585 

—0.660 < A^ < 0.654 

^here |j|-x is the direction down the hole (note that this is a different coordinate system to 

that uEJflid by Taylor). These bounds compare favorably with those obtained by Taylor: 

—0.05 < Ax < 0.05 
—0.54 < Ay < 0.54 
—0.62 < Az < 0.62 
ichielred smaller estimates by using more powerful numerical methods, and by 
son* small terms. 
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essions for Ax and Az arc similarly complex. 



by carrying out the computation symbolically it is possible to answer a much 
)f questions about the geometry and the constraints. Rather than simply 
error estimate based on propagation of errors through the physical system 
possible instead to start from a desired tolerance and infer constraints on the 
Ion. 



Si)i)posd for insi-ance, that the insertion task illustrated in figure 5 is to be achieved by 
applyiii 5 a d wnward force, compliant about the screw tip, using either a passive compliance 
device e.g. Drake (1977)) or active dynamic control (e.g. Salisbury (1980)). Then it is 
sufRcidilit th{ t the tip of the screw falls somewhere in the top of the open hole. Note that 
opeling is the size of the head of the screw rather than the size of the screw shaft. 
Compl|i|knt r lotion will guide the screw into its correctly seated position. This constraint 
?xpr^sed by 

y/{Ay)^ + [Azy < 0.25 

le opening has radius 0.25 inches. To simplify the algebra slightly so that the 
algoritfljms ( escribed in Brooks (1981a) can handle it, and since the errors in the y and 
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are essentially independent, it is sufficient in this case to approximate the 
int with the following two: 

~0.25Vcr5 < Ay < 0.25v/a5 
-0.25\/cr5 < A-? < 0.25vC5 

nstraints ensure that the action will succeed. They can be used to check the 
nsertion task in any well characterized circumstances. 



wing example uses a tighter set of constraints than those used by Taylor on 
ement of the box. The box placement errors be used tend to swamp any other 
\ sniillcr amount of wobble in the attachement of the screw to the screwdriver is 
as$iume(i The following bounds on the errors are assumed: 

—0.05 < BOX-DELTA-PQS-X < 0.05 

—0.05 < BOX-DELTA-POS-Y < 0.05 

—0.5° < BOX-DELTA-ORI < 0.5° 

—0.05 < HAND-DELTA-POS-X < 0.05 

—0.05 < HAND-DELTA-POS~Y < 0.05 

—0.25° < HAND-WOBBLE-X < 0.25° 

—0.25° < HAND-WOBBLE-Y < 0.25° 

—0.25° < HAND-WOBBLE-Z < 0.25° 

—2° < SCREW-WOBBLE-Y < 2° 

— 2° < SCREW~W0BBLE-2 < 2° 

It is fiiiither l^resumed that the screwdriver length is not pre-detcrmined — i.e. there are 
a numoitir ofl screwdrivers of different lengths available for use. The plan generated must 
includ^ seledion of one for this task, however it is known in advance that 

DRIVER-LENGTH > 0.0. 



Fi(im tl: s bounds on the errors and the expressions for Ax, Ay (such as above) and Lz 



to deduce bounds on those expressions in terms of the undetermined variable 
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;ymb )lic analysis of the uncertainties in the positions and orientations of workparts 
robjb manipulator has provided a constraint on the tool to be used to achieve the 
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164 - 0.004420 X DRIVER-LENGTH < Ay < 0.164 -\- 0.004420 X DRIVER-LENGTH 



desp-ed constraints on Ay and Az can then be applied to these bounds. Thus 

-0.25\/0.'5 < —0.164 ~ 0.004420 X DRIVER-LENGTH 

0.164 -f 0.004420 X DRIVER-LENGTH < 0.25\/Q^ 

-0.25\/a5 < —0.162 — 0.004204 X DRIVER-LENGTH 

0.162 4- 0.004204 X DRIVER-LENGTH < 0.25\/a5 

to guarantee that the insertion strategy will not fail due to the screwdriver 
ulfcide of the boundary of the hole. These inequalities are satisfied whenever 



goal. 



L For instance 



DRIVER-LENGTH < 2.92. 



dt 5 



Coupled Plans. 

ction four coupled planning islands are considered. A plan checker propagates 
actions from one island to the next, cliecking whether the errors accumulate 
^ree that planned actions are untenable. When this happens it chooses the 
the sequence of steps to introduce a sensing operation. At the same time it 
resolved decisions within the plan framework. 

iputations for these examples were carried out by an improved version of 
t system described in Brooks (1981a). The new version can handle explcit 
)f constraints (whereas the old version dealt only with conjunctions). Coupling 
itroduces disjunctions. As a by-product the new version is also able to handle 
ms better than the old. 
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Cdilside figure 6. A box has previously been put on a table by a two link manipulator. 
The tablk is lor the manipulator to place a lid on top of the box then insert a bolt. The 
only sdiUrce Jf uncertainty considered is the inaccuracy in the joints of the manipulator. A 
visual qpsitic n sensor is available and is subject to error. 
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Vk ma lipulator has two links and two parallel revolute joints. It is thus restricted to 

gle vertical plane. Each link is 24 inches long. Each joint can be positioned 

1^. The plans below only require that it operate at approximately the height 

, and at a range of 12 to 36 inches from that joint. Using the coordinate 

in figure 6 the uncertainty Ax in the x direction of its end-effector when 

nomin^Hly al coordinates (x, 0) can be bounded by 

nax(0.00022]5i — 0.043262,0.0009857a: — 0.063329) < Ax 

min(0.043262 — 0.0002253x, 0.063329 — 0.0009895x) > Ax (2.2.1) 

I [12, 36]. These bounds are no more than 6% larger than the actual uncertaintities 
hflit ralge. Note that the position error is larger for smaller x and smaller for larger 
y petition error behaves inversely to the x error. I.e. y error is small for small x 
lai"fee fo large x. However in these plans only the x error is considered. 



is 2 inches long in the direction parallel to the x-axis. Initially the box sits on 
h an X coordinate represented by the named physical quantity boxrposition. 
was placed on the table by the manipulator, the uncertainty in that position 
characterized by (2.2.1) above. The bolt hole in the box is 0.125 inches in diameter. 



of the box is the same size as the box. The hole through it has a 0.125 inch 
ares to 0.25 at the top of the lid, 

t is 0.125 inches in diameter. The tip of the bolt narrows down to 1/32 ^ 
es diameter at the tip. Once the tip is seated in a hole the manipulator is 
ough for the bolt to be inserted without moving the object into which it is 
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two link manipulator must place a lid on a box then insert a 1/8 inch bolt 
inch tip) through the lid with a 1/4 inch opening and into a 1/8 inch hole in 



d. 



2 vist al sensor is placed directly above the base of the manipulator with a horizontal 

ightJ It can measure the distance of an object on the table top by the displacement 

linage from the center of the image plane. The sensor is subject to error, and the 

the dptance it must measure, the larger is the error. The implemented plan checker 

beldb rui with a number of different models for the error characteristics for the sensor. 



are modelled by two functions: Ig and fg dependent on the sensor reading 
a true physical value v the sensor will produce a reading m such that 



m -h ls(m) < i' < m -|~ r^lm). 
19 



Aii exarfple sensor has —/^(m) = rs{m) ~ 0.0004 X m, and then for physical value v 
the sediior is|guaranteed to give a reading m where 

m -f ls(m) = 0.9996 X m < v < 1.0004 Xm^m-\- hs[m), (2.2.2) 



2,2.2 A 



Tfi|^ pla 1 is broken into four subplans; (A) move the lid to a position above the box, 
(B) pu|- dowi the lid, (C) move the bolt to above the Ud and (D) insert the bolt. Note that 
the ste^ s to icquire the lid and bolt are ignored in this formulation. This is to simplify the 
problejii for )resentation. 

Tble inimal state of the world is determined by the position of the box. It was placed 
by the nanilulator at box:.'position with uncertainty given by (2.2.1). 

Tqp fotj- subplans are given in more detail. The full details of how they are presented 
to the j|mplelnented plan checker are given in the appendix. 
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lid is moved to a position called iid:position. It has the same nominal value 
.ion. The only requirement is that the nominal position for the lid is within 
wc|^kspa|e of the manipulator, i.e. 

12 < iid.'position < 36. 

t position for the lid will be subject to uncertainty characterized by (2.2.1). 



lid is released onto the box. For the subplan to work, it must be that the 
of the lid is above the box. Since the box is 2 inches wide this means that 

— 1.0 < iid.-position — box:position < 1.0 . 



bolt is moved to a position called boit:position. It has the same nominal 
>osition. As in plan A above the only requirement is that 

12 < boit.-position < 36. 
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.-3/6 [ — —0.046875 < iid:posltlon — box:posltlon < 0.046875 = 3/64. 

2.2.3 >\|i||aiysj j of the four plans, 

Tlitise f< ur plans will be used throughout the text to illustrate the plan checking 
procesdJ In s action 5 a plan checker is demonstrated analysing those four plans and their 
interactions. A summary is given here. 
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olt is inserted into the lid and through to the box. For the tip of the bolt to 
wif lin the flared hole in the Hd it must be true that 
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position for the bolt will be subject to uncertainty characterized by (2.2.1). 



= —0.109375 < boit.'position — iid:positlon < 0.109375 = 7/64. 

comply with the hole in the lid. The condition necessary for it to be inserted 
in the box is then 



'Ti^ pla 1 checker follows through plan A through to plan D before it encounters a 

In plan D the bolt tip can inserted into the lid without the aid of sensing, but 

unce -tainties in the positions of the box and lid have built up so much that there 

,ee that they will Une up well enough for the bolt to slide though the hole in 

Jie hole in the box. 



checker identifies the troublesome uncertainties as those for the box and 
but recognizes that the bolt's uncertainty is not an issue. It briefly considers 
the box and lid positions, but without doing any uncertainty analysis it realizes 
sing will not change the geometric possibihty of misalignment. The check 
up through the plans propagating back the information that the uncertainty 
a id lid positions seem to be the cause of the problems. 



C the checker considers sensing the hd position before choosing a nominal 
he bolt. It propagates the new uncertainties through to plan D but finds again 
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1 Ian I it decides that there is nothing to be sensed which will be any different from 

ady .ried in plan C. It continues to back up and gets to plan A. It decides that 

the mcertainty in box:position may suffice. It introduces the use of the visual 

the box position in plan A, then propagates the effects forward through the plans. 

fl non inal values for iid.-position and boit;position depend on the sensed value 

1t)osilion rather than the a priori value. 



fund 
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imental problem has not been changed. The checker resumes the backing up 



,hat a sensor with error characteristics given by equation (2.2.2) is used. 



tl|e checker returns to plan D it finds that the plan will succeed so long as the 

sition is around either end of the range of [12,36]. If the box is placed at 

)f this range then the sensor accuracy is high and even with an inaccurate 

he lid can be placed sufliciently well on the box for the holes to align. If the 

at the high ned of the range, then the sensor accuracy will be lower, but 

so introduced will be compensated for by the increased horizontal position 

e manipulator in that range. If the box is placed in the middle of the range 

out that the accuracies of both the manipulator and the sensor are sufficiently 

e holes in the box and lid can not be guaranteed to be aligned sufficiently.^ 



h( 



r^kult Airprised the author. In thinking about it qualitatively before running the example 

the p an checker it had seemed that the any restrictions on where the box should be placed 

of a form that constrained it to the middle of the range [12,36]. The reasoning was that 

n€^i]ther 1 le sensor nor the manipulator would be sufficiently inaccurate to cause the plan to 

Feverl for that to happen the shape of the sensor error characteristics must be somewhat 
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3. A Model of Plans and Sensors 

Th^ basil model of a plan used in this paper is that there is an initial state, a final 

aiJIfl a p|an of action to change the initial state into the final state. There are three 

this basic model. There may be uncertainty in the initial state, there may 

on the applicability of the action, and the planner may generate a plan with 

final state. All these need to be quantified. Furthermore the plan may be 

^Ikiall lart of larger plan - a planning island. Decisions concerning certain details 

ailtd wlh the plan may have to be deferred until adjacent plans in the plan island 

b( en finalized. Alternatively, the decisions required for the various islands may 

ependcnt. 
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Tli^re n ay be uncertainties in the robot planner's knowledge of the initial state, so 
the plafll mu£ ; be able to handle a set of initial states. For instance in the example used in 
section |?.l tl e set of initial states was all possible combinations of the block's position and 
orientation o i the table, the hand's position and orientation, and orientation of the screw 
on the ih) of the screwdriver, subject to the constraints given. 



on may be applicable over a class of states. For instance the screw in the 
;ection 2 could be inserted as long as the tip was somewhere within the 

of the hole. Given the uncertainties in the initial state of the world, the 

must determine whether the desired action is aplicable. 



Tlkl^re n|ay be a range of final states of the world that are acceptable. For instance, If 
the tadi is sliiply to throw a part in a bin then the particular position and orientation of 
the pall is njt important. It suffices that it is somewhere within the confines of the bin. 



; islands provide a hierarchical decomposition of large plans into smaller plans 
iled levels of abstraction. The model used for a plan in this paper deals with 
at a single level of representation. Section 6 discusses linking such plan 
context of constraint satisfaction as introduced here. A sequel to this paper 
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In^lvidiil functions are written as words such as DECIDE or support. Upper case 
functiotNs are! those for which there exists a program to compute their values. Lower case 
functic^iHs ar4 mathematical entities which may not be computable. 
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formlUze the model of a plan it is necessary to introduce some notation. The 
duced in this section is sufficient to follow up to section 5 when more will be 
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1 strai it. 
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Sidkle ulper case letters, perhaps with subscripts, such as P or C^ refer to sets. Lower 

ers, ! uch as e are used to refer to mathematical individuals. Strings of letters set in 

pewriter font, such as BOX-POSITION-X are formal variables of a plan. Strings 

such as box:length refer to slots in the geometric model of the world. Such 

it actual physical quantities. 



s defined on a domain are sometimes applied to a subset of that domain, 
image of the subset under the function. 

ons are constructed from constants, formal variables and slot names. Con- 
irst order sentences over boolean-valued predicates applied to one or more 
Thus 

3.0 4- BOX-POSITION-X + BOX~POSITION-DELTA~X 



ion while 



0.03 < BOX-P0SITI0N~DELTA-X X cos(BOX-DELTA-ORI) < 0.03 
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A kU of fconstraints is written as a subscripted C, such as C^ and Cj. The subscript 
identifi^ a p irticular constraint set. A set of constraints is equivalent to the single con- 
straint hHrhichlis the conjunction of its members. 



DEFlNjttlONi The support of an expression is the set of atomic symbols which appear in 
n support(e). Similarly 8upport(c) is written for the union of atomic symbols 
n all the expressions in the constraint c, and support(C) for the union of the 
1 the constraints in the constraint set C. | 



it. It is 
which 



A^ritt 
oltcur 
supports of £ 



Foil} exai iplc the support of the expression above is the set 



{ BOX-POSITION-X, BOX-POSITION-DELTA-X }. 



DEFINtI1^I0^ : The range of a formal variable v is denoted range{v) and is the set of values 
that aiii be ; ubstituted for the variable. 
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DEFlH^triOll: A set of variables V defines a space, denoted space{V), which is the cross 
produc|^ of t|e ranges of the elements of V. I.e. 

space{V) —■ JJ ranqe[y) 



of the product is arbitrary but fixed for index sets V . | 

p € Bpact{y) can be written (Pvi,Pv2,..Mpt;n), where the product forming 
rdered Vi, v^, . . . , ^n- Given p E space(V') and v G ^ the v%\\ ordinate of p is 
id of course p^ 6 ran^e(ii). 

m variable sets W and V where VK C V, &pace.\y\l') is identified with the 
latural subspace of spoce(V). 
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Given variable sets W and V, where W C V, and a subset S C space{V), 
\Vy S) is the projection of 5 into space{W). I.e. 

oroj{V,W,S) = {9 € space{W) \3pe S,^w G M^,p,^ = Qw }.| 



: Given variable sets W and V^ where W C V, and a subset R C space{W), 
V, R) is the largest subset of space(V) which projects into R. I.e. 

t{V,W,R) ^ (pespaceiV) \ 3q £ space(W),\/w G H^,Pii; = Qw}- 



proj{V,W,lift{V,W,R))^R.n 

Given an expression e and a variable set V where swpport(e) C V, and 

then [elv(p) is the interpretation of the expression e at the point p. Its value 

of evaluating e with the substitution of p^ for v throughout for each variable 

). The definition has a natural extension to the interpretation of a constraint 

is. a predicate on the domain 3pace{V). The definition can be extended to 



encompass f artial evaluation of expressions. Thus if 



V C support(e) ~ U 
Afill be an expression with support inU — V and will be the appropriate partial 



e, I.e. 



"iqeU-V, [le]v{p)]u~v(q) -= Wt/W 

such that proj(U, V^r)^ p and proj(U, U — V^r) ^ q. 
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X-POSITION-X -f- BOX~POSITION-DELtA--Xl{B0X-POSITI.0N-DELTA-X}(0) 



BOX-POSITION-X. 



Given a constraint c and a variable sot V where support(c) C V, the 
of c over space[V), written aat{c, V), is the set of all points in space{V) where 



sat{c,V) = {pespace{V) \ [c]v{p)} 



lint set C and a variable set V where support(C) C V, the satisfying set 
sp ice{V), written sai(C, V), is the set of all points in space(V) where all the 
nstr^ilnts ii C hold. Le. 

sat(C,V)= f] sat{c,V).i 

ceC 

N<Hie thjt for a constraint set C where support{C) C W C V then 

sat(C, V) = lift{V, W, sat{C, W)). 



N(3 :e ah o that for two constraint sets, C^ and Cs, and variable set V then 



sat{CA UCb,V)^ sat{CA, V) n sat(Cs , V), 



iuppo 't(Cji) C V and supportlCs) Q V. 



3.2 Refiresei ting uncertain physical situations. 

Ttibre afe two types of uncertainty which a plan checker nriust deal with. Plans can be 
made diiite letailed, yet still incorporate unresolved decisions. Even at execution time the 
robot <tl|>ntro ler will not have exact values for physical parameters. These are both handled 
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Vfiilablel whose values will not be known even at plan execution time are called 
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I two distinct sorts of variables: those whose values though not known at plan 
ha\ 3 at least a known nominal value assigned them before execution time, and 
/ill not be known even at execution time. 



nting physical values. 
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formal variables to represent uncertain knowledge and constraints on formal 
is known. 



a 1 



quantities are represented in geometric models by names. An ad hoc nam- 

s used in this paper to avoid the introduction of unnecessary machinery. 

A in the example of section 2.2. The only physical quantities represented are 

and iid:position. In a more realistic representation of the plan, the named 

itities would include, faox.-width, iid.-width and Jid:f eeder-position. 



ei 



physical quantity is represented as the sum of a plan variable and an un- 
iable. Thus for instance in plan A the position of the box on the table, 
itic Q, is represented by the expression 



BOX-POS -h BOX~UNC. 



variable BOX-POS whose exact value may be unknown at plan time represents 
value of the position of the box at plan execution time. The uncertainty 
■UNC represents the uncertainty that the robot controller will have concerning 
acHiial p lysical position of the box at plan execution time. 
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This value for BOX-POS can correspond 
to all the shaded physical situations. 



BOX-POS 



All points on thi.s line segment 
represent the same physical 
situation. 



physical quantity may have many different representations at plan execution 
ler figure 7. The uncertainty variable BOX-UNC is bounded above and below 
of the plan variable BOX-POS. A particular value for BOX-POS can model many 
;al situations - one for each value of BOX-UNC which lies within the bounds. 
;iven physical situation can be modeled by many values for BOX-POS. Any 
ysical situation corresponds to a straight line segment, with slope ~1, as 
figure 7. Any value for BOX-POS which Hes in the project of the line segment 
ion of the line and and the bounded region) onto the axis is a valid nominal 
n of the physical situation. 



3.2.2 JJ omin il valves of expressions. 



|e nofiinal value of an expression can be recovered by substituting zero uncertainty 
out. Thus if P is the set of plan variables and U the set of uncertainties, then the 
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instance the nominal value of BOX-POS -f BOX-UNC is BOX-POS. The functional 
acts on named physical quantities. Thus if box:position is represented as 



nomma/(box;position) = BOX-POS, 

atical device will be useful when it is necessary to extract the nominal value 
!xpression. 

pecified and unspecified in a plan. 



time there may be unresolved decisions and so not even the nominal initial 

known. At execution time there will be many uncertainties in the actual 

sical quantities. Thus a plan must consider a set of initial states, ranging over 

u|iHresol|fed decisions and physical uncertainties. With many possible initial states to 

are many possible final states. The action of the plan thus becomes a maping 

tates to final states. 



of a plan checker is to ensure that for all possible initial states the planned 
licable and will lead to a final state that can be handled by the next step in 



irtion task in section 2.1 can be planned in some detail in terms of a nominal 

he block on the table while still representing it as a variable. Before the plan 

ecuted a specific nominal position will be chosen. (Note that it may be chosen 

ly before the plan is executed - perhaps on the basis of a sense operation.) 
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Itistants and variables in the set P[JU, representing named physical quantities. In 

piber olily the correspondences between named physical quantities and expressions 

ti iting them are considered. The details of representation of geometrical relations are 

id. 
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island^ 
this pEifcer 
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sider 



ie set 
from 



the asij )ciat; an 



! set 



)f all pian variabies in a plan is denoted P. 



3f all uncertainty variables in a plan is denoted U. 



CO]] 



A ^et oi initial constraints, Cj, where suppori(Cj) C PijU, constrains the possible 
initial !|tatet| to which the planned action may be appHed. Furthermore, sat{Cj,P [jU), 
those i|i||terp|etations of the variables which satisfy all the constraints, can be considered as 
the sell bf pJssible initial states. 



Cj is derived by the planning system by tracing through the geometry of plan 
the given initial state of the world. Its initial derivation is not a concern of 



AH an example consider plan A of section 2.2. There is only one physical quantity to 

be rcf^jleseniBd, namely box:position. The initial states of the world of plan A can be 

repres^ted jy the sets 

P ™ { BOX-POS } 

U ™ {box-unc}. 



box:positioQ ~ BOX-POS -f BOX-UNC, 



■ J consisting of the constraints 
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where 
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3.3,2 Aition 



Associa 



action 

purely 

is 

identit 

aspect! 



i 
Will 
geon 
assigned 



plai 



box:position == BOX-POS + BOX-UNC 
iid:position = BOX-POS ~f- LID-UNC 

conasting of the constraints 

12.0 < BOX-POS < 36.0 
ei(BOX-POS) < LID-UNC < e/i(BOX-POS) 
ei(BOX-POS) < BOX-UNC < e/i(BOX-POS). 



12.0<B0X-P0S<36.0 
ei(BOX-POS) <BOX-UNC < ChIBOX-POS) 

ei(x) = max(0.0002215x - 0.043262, 0.000985Tx - 0.063329) 
ek(x) = min(0.043262 — 0.0002253.T, 0.063329 - 0.0009895x). 

B the initial states of the world can be represented by the sets 

P = { BOX-POS } 

[/ = { BOX-UNC, LID-UNC }, 



ed with an action are certain applicability pro-conditions. The robot planner 

genera(1[^s ttjese conditions as sufficient to ensure tliat the geometric consequences of the 

dorrespond to the modelled consequences. Some of these constraints might be 

etric. For example an insertion action requires the existence of a hole. It 

hat the robot planner has ensured such prerequisites and can transmit the 

^ of slich geometric features to the plan checker. In addition to the gross geometric 

therj may be certain finer details which can be conveniently expressed in terms of 

parameters. For instance in the insertion task of section 2.1 there was a condition that the 

tip of t le sc|-ew lie within the circumference of the hole. This is an abstract pre-condition 

for the appllcablity of the insertion action. In the example it was translated in two steps 

into c<l)|iiditi( ns on the plan and uncertainty variables. Firstly it was expressed as 



yf{Ax)^ -f {Ay)2 < HOLE-RADIUS 
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checker model of this paper assumes that the robot planner carries ont the 
inl|erpretation of the abstract action applicability conditions into constraints on 
uncertainty variables. Let that set be C^ for applicability constraints. Note 
Ca)CPUU. 



and 



plai 
the 



m 



econ es 



i 3 the 



3.3.3 Final « tate 



much more complex expression as the quantities A.t and Ay were related to 
resenting the state of the world. 



A the abstract applicability condition is that the lid be moved to some 
workspace of the manipulator. Since the lid is to moved to physical position 
then the condition can be expressed as 

12.0 < nomi7ial{lid:position) < 36.0 

12.0 < LID-POS < 36.0 
single member of the set Ca- 

B it is necessary that the center of gravity of the lid be above the extent of 
;e the box is two inches wide, and its coordinate system has the origin in the 
box, and similarly for the hd, the condition can be expressed as 



1.0 < iid.'position ~ box:posltion < 1.0 



— 1,0 < LID-UNC ~ BOX-UNC < 1.0 
single member of the set C^. 



] state of the world is similar to the initial state in that it is represented by 
associations of expressions and named physical quantities and constraints on 



33 



Th 
the act L in is 
Sometiiliies it 
positiori with 



he. 

taintics 



the action its jlf 



The 



uncertf,: 



met I y 



as a 

geo 

relates 

states 



siii: 



If 

initial 

that 

satisfy 
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consists 



acti|)n of a plan transforms the initial state into the final state. Sometimes 
modeled purely geometrically, as in the insertion example of section 2.1. 
will introduce new uncertainties into the world. Plan A moves the hd to a 
uncertainty determined by the position uncertainty of the manipulator arm. 



V bj the set of introduced uncertainty variables. Members of V model uncer- 
not f resent in the world before the application of the action, which are a result of 



res 
|nty i 

pie 

of 

tthe i 

the 
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Lll 



ts of an actiop can not, in general, be modelled precisely. This is the souce of 

the plan checker's model of the world. Thus the action can not be modeled 

nction from the set of initial states to the set of final states. Instead the 

be action is captured by a set Cg, where support(Cg) C P\JU \JV, which 

iiitial state of the world to the introduced uncertainties. Thus the possible final 

world are 

sat{Cj UCg,P\jUUV). 



he 
pronP U 



an e 
oft 



le gefcmetry constraints correspond to a physically realizable action, then for every 
iltate ■ /here the action is applicable, it should be the case that there is a final state 
Jisfiejthe constraints of the geometry. Thus the geometry constraints Cg must 
piysical realizability condition 



J U V,P U U, sat(Cj UCAUCg.PUUU V)) = 3at(Cj U C^,P U U) (R). 

;ample the geometric constraint set Cg associated with the action of plan A 
e singleton 

ei(BOX-POS) < LID~UNC < e/i(BOX-POS) 

where .lie introduced uncertainty variable set is f = { LID-UNC }. The introduced association 
is that 

Jid.-posltion = BOX~POS + LID-UNC. 
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3.3 A Sv.amai y. 



In 



subject 



^mm iry, a plan is specified by its geometry g and by three sets of variables 

P plan variables 
U initial uncertainties 
V introduced uncertainties 
to thjee sets of constraints: 

Cj initial constraints support{Ci)C P UU 

Ca applicability constraints support{CA)C P \JU 

Cg geometry of action support(Cg)C P\JU\JV 
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try 



geome 

to reprfeteent 

3.4 Acccptab 



desired 
of the 



general 



3A,1 Tie ac 



an 
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w ith 



Tl: :: roh 



resul 
rtiode 



appr 



geometry g is written as an 7-tuple (g,P,U,V ,Cj ,CA,Cg). Note that the 
eludes the associations of named physical quantities and algebraic expressions 
hem. 

e plans. 



of a plan checker is to decide whether a plan will work and produce the 

. The mathematical criteria for these objectives are easily stated in terms 

developed above for plans. They are stated below. There is however some 

difiiculltlir in f-anslating these abstract criteria into algorithms. Sections 4 and 5 develop a 

ach and describe a particular algorithm. 



ion must be applicable. 



Tlkl^ gco netric constraints Cg, describing the effect of the action on the initial state of 
the wojrld ar( vahd only if the applicability conditions are satisfied. Thus to guarantee that 
the finlJ) Stat 3 of the world meets the derived constraints it must be that the applicability 
conditldJns a; e satisfied for all possible initial states. Thus 



sai{Cj,P[jU) C sat{Cx UCa, PUU). 
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3.4,2 n 



TM plal used for a single planning island must leave the world in a state that is 
feasibl(j for tl e next island in the planning chain. Thus a goal condition can be formulated 
for a pMn: gi rm any valid initial state a plan should produce a state of the world that is a 
vaild iiilbal £ >ate for the next plan. 



set of p 



Suppose 

an V 



In 



I smi 



)le model of planning one could demand that P — P* and U\JV ~U . The 
goal co|]|iditic i for a successful plan then becomes 
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that the next planning island in the chain has an initial state described by a 
riables P* , a set of uncertainties U* and initial constraints C}. 



(Cj U Cc;,P U ^ U V^) C sai(C],P* U U*) = sat{C],P\J U U V), 

stic planning sytem that assumption can not be made. Variables can both be 
id removed at various points along the temporal sequence from plan island to 



Vii-iabh 8, including plan variables, are introduced by sensing operations. Examples 
I below in sections 3.5 and 4.2. This type of variable introduction does not 
i|e gotil condition statement, as the variables are not used in the description of the 
>f the plan in which they are introduced. 



Viijhabli 8 may be introduced for a second reason. To decrease the complexity of 

of ] Ian islands, it might be the case that aspects of the geometry of the initial 

world are ignored until the first plan step in which they are relevant. In 

introduced variables must be independent of the state of the world described 

results of the previous actions. The introduction of such variables considerably 

the statement of the goal condition, but in reality add little to its meaning, 

implementation of algorithms to check that the condition is met. Therefore the 
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remain#r of this paper assumes that all aspects of the world geometry are modeled from 
the initlM sta .e of the world, and propagated through all actions. In an implementation of 
the alg^thn s presented later in this paper it is easy to add in this aid to efficiency. 

Variable are removed when all named physical quantities with which they are as- 
sociate^ beco Tie meaningless. For instance if an object is put down at some temporary loca- 
tl^^n pic ced up, the variables which describe its temporary location have no geometric 
10 resultant state of the world. Such variables are removed from the descrip- 
^orld state of all following plan islands. This convention is assumed to aid in 
g of planning islands. It may mean that a sequence of plans, for which a valid 
iriables can be chosen, might be rejected due to failure to understand subtle 
if uncertainty dependence between plan islands. This paper assumes that the 
increas|4ii efTi nency derived from the decoupling allows extra planning effort, to find better 
structiililed p ans in such obscure cases. 



ni 



in t 
the 



tion, 

meani 

tions o 

the dec|(|uplii 

set of It) an V 

interacltllons 



It 



an t ms be assumed that P* C P and U* C U [JV. The goal condition now 



jenso 
measut jmen 



becomw 

proj PUU[JV,P*U U\sat{Cj UCg,P [JU UV)) C sat(C*j,P* U U*). (G) 

3.4.3 Mtind jians. 

DEFlMt^nOI" : A plan (g,P,U,V,Cj,CA,Cg) whose following plan has initial state 
descriHM by|p*, U* and Cj is called sound if both conditions (A) and (G) are true. | 

ib goJ of a plan checker is to either certify that a plan is sound or modify it so that 
it is solind. p. sound plan is illustrated in figure 8. 

3.5 WWkt a ensor is. 



is used to measure a quantity in the real world. All sensors are subject to 
errors. A plan checker must have a realistic model of a sensor and its error 
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Figure 
which 



1$. A lound plan has an action which is applicable for all possible initial states, and 
produjes a final state expected by the following plan. 
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able quantities. 

ty which can be measured must be geometrically represented as an expression 
ysical quantities. In addition a sensor which can carry out the measurement 
lable. 

e is the expression in named physical quantities, and / the result of susbstitut- 
he representations of the named physical quantitities in a plan 

(g,P,U,V,Ci,CA,Cg). 

t(f) C P\JU. Expression / can be broken into the sum of a nominal expression 
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Thus t 
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Tyincal 



the coo 
object 



(ir the 



Fc:' exa nple consider a flat rectangular object whose length, objrc t.'length, is repre- 
sented 



where UENGTI 
a suitalile se 



If there 
of the 



n=[f]u(Ou) 

u =/ -~ \f]u{Ou)- 

e unfertainty in / is zero if the uncertainties in all the named physical quantities 
t of e are also zero. Note that 



rdina .es 



,:LS 



is a 

tibp ol 



certainty expression u by writing 



support{n)CP 
support{u)CP U U. 

examples of geometrically measurable quantities are the length of an object, 
of the position of a detectable feature on an object, the orientation of an 
area covered by an object on a back lighted table. 



and width, c bjeot.-width, as 



LENGTH -}- LENGTH-UNC 



WIDTH -f WIDTH-UNC 



and WIDTH arc plan variables, and the others uncertainty variables. Then with 
isor the length of the object could be measured and in that case 

n = LENGTH 

U = LENGTH-UNC. 

vision system available which can measure blob areas, then perhaps the area 
the object could be measured. Then 

n =LENGTH X WIDTH 

u =:LENGTH X WIDTH-UNC 

-h WIDTH X LENGTH-UNC 

-f LENGTH-UNC X WIDTH-UNC. 
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3.5.2 Sv.nsor 



AMt serpor s capable of measuring a geometric quantity modelled by the expression 
n -f u inherlntly provides a measurement which is subject to error. Thus it provides a 
measuri$men which is the true value of the quantity in the real world plus some error term. 
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;ensor s can be read by evaluating READ(s) (recall that uppercase function 
pond to functions for which there is a piece of computer code somewhere), 
lominal value returned by the sensor. If correctly modelled then the actual 
e t; of what is being measured lies somewhere within an error range of this 
e. Let 

m = READ(s) 



3rror is a source of uncertainty. 



s is modelled algebraically by two error expressions, namely Is and r^ (for 
), where 

supportilg) = support{rs) ~ {READINGg }. 



m-\- [/sl{READING„}M < V < ^+ hl{ READING. >M. 

that ihe notation |/s]{reading« ) is a X~expression which turns Is from an expression 

va iable into a function of one argument,) Thus a sensor can have an error 

n#nt (§1 the value it measures. This corresponds well to most physical sensors; 

ly thi)se that are non-linear. Often, of course the error expressions will be constants. 



an e tample, consider a sensor s which delivers a reading with ^10% error. Then 



./. =r fc = 0.1 X READING.. 



Cldbsidfi- figure figure 9. A sensor is being used to read a value for the named physical 
quanti|t|^ bo: .-position. It is represented as before by the expression 

BOX-POS H~ BOX-UNC. 
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sensor produces a bound on possible physical values. The correct nominal 
ewherc in the bounded part of the plan variable axis (refer to figure 7). The 
gives the valid representations of the physical situation. 



jts a bound on the actual value of box:position. Recall that a given physical 
represented by any point on a line with slope -1 in a diagram such as figure 
ich lines which go through the bounded region of the horizontal axis comprise 
sible realities which are consistent with the sensor reading. It makes no sense 
ue for BOX-POS which is outside the bounded region. Thus any representation 
situation which is consistent with the sensor reading should be a point in 
on of the figure. At plan execution time the sensor reading can be used to 
variables BOX-POS and BOX-UNC to define a point in this region. 



r' gi 



error expressions are used in different ways by the plan checker and the 
er. The plan checker uses them to generate symbolic bounds on the errors 
iherent in nominal values chosen for plan variables at execution time. The 
er uses them to generate numeric bounds on the actual sensor readings so 
oose a set of nominal values for the plan variables which are consistent with 
ings and with the state of the world known from previous steps in the plan. 
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approach requires the comparison of satisfying sets of different sets of con- 
be quite difficult to explicitly compute satisfying sets whenever non-linear 
involved, and it is also difficult to compare them. In addition simple failure 
3f the conditions (A) or (G) may give no hint as to how to modify the plan so 
:ceed. In general it is easier for a plan checker to modify a plan to guarantee 
plan is sound, rather than trying to decide whether a given plan is already 
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4. What A Plan Checker Can Do 



lans P and P* where 



P=={9.P,U,V,C:,Ca,Cc) 



immediately follows P in the planning island chain, a plan checker could decide 
by checking whether the conditions (A) and (G) were satisfied. 



est way to modify a plan is to put extra constraints on the plan variables. 
36 chosen for those variables before execution time, and the plan checker can 
ee that the plan will work by simply constraining those choices. If that fails 
cessary to introduce sensing into the plan. Section 4.2 gives an analysis of 
sensing on a plan. Sensing essentially decreases the uncertainty in the world, 
coniraints can be added to the initial state of the world to reflect the increased 
at the robot controller will have at plan execution time. Section 4.3 relates 
pej-ties of these various sets of additional constraints to the six possible outcomes 
I plan given in section 1.2. 



4.1 Coriurre itly checking and rescuing a plan. 



lod proposed here requires a plan checker to construct an additional set of 
^ (the M is for new constraints), where support{CM) C P\jU, such that the 
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Tl|i|^ perlormance of a plan checker can be measured in terms of the properties of the set 

s able to compute. Some care must be taken in computing C>/ to avoid wishful 

re the constraints on certain of the variables are physically unrealizable. It 

a\i)id making unforced decisions at any given plan island so a minimal C>/ is 

ow a minimaUty condition is defined for C>/. 
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C>/ can not be chosen arbitrarily. It is easy to construct constraints which 
wishful thoughts about the initial state of the world. 



£ )me specific sensing operation is to be added to the plan, or some previous steps 
to be re- planned to meet new initial uncertainty constraints, C>/ should not 
nstr^n an|f initial uncertainties for any set of values for the planning variables P which 
th the old plan and the new. I.e. the following condition must be true. 



[/, P, sat{Cj U C.K/, P U U)), (4.1.1) 

U t/, P, p) n sat(Cj UCj^,PUU)== lift{P UU,P,p)n sat{Cj,P U U) 



m is easily satisified when support{C j^j) C P. In fact there is an equivalent set 
in s with support contained in P whenever the above condition is satisfied. 



)lan checker should first try to compute a set of constraints Cm such that the 
sound and supportlC^) C P. If it fails to do that, it can try to compute a 
e 8upport{C m) C P ijU, so long as there exist sensing operations which will 
itial state of the world to be determined within the uncertainty requirements 
!!>/. A prerequisite for this is that the uncertainty requirements be physically 
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(fxprefsion 

BOX-POS -|- BOX-UNC. 

36 thfet the constraints C>/ imply that for the plan to succeed it naust be the case 



BOX-UNC G [—0.05, 0.075]. 

sensing operation would be physically realizable with a sensing device having 
)f ibO.05. However it is highly unlikely that 



inst nee, consider the measurable quantity box:posltion from plan A represented 



BOX-UNC G [0.125,0.25] 

I physically realizable. Such a range simply does not make sense as an error 
1 sensor. 

lity of addiiional constraints. 



Till J nev constraints C>/ narrow down the set of possible initial states since 



sat(CjUCM,PUU) C sai{Cj,P\jUy 



A aesirJble property of the set of new constraints C>/ is that it remove the minimal 
numbed of a|lowable initial states of the world at the same time as they ensure that the 
plan willl woilc. This is equivalent to arguing for a maximal satisfying set of C; U Cj^. Note 
that thlis is ij no sense a condition of the complexity or size of expression of the constraints, 
but railier o| their effect. It is a desirable property because it allows maximal freedom in 
detaileld plarjning concerning the other planning islands in the overall plan. It provides the 
least c^tistralnt on the rest of the plan. 

Ts/j^ per brmance of plan checkers can be compared more formally as follows. If two 
plan c(i|^ckeifc fix a plan by responding with the same outcome amongst 1 through 6 of 
section] jl.2, 1 ut with different sets of additional constraints, C;^/, and C}j,^ say, then C,v, is 
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smaller 



sat{Cj UCm,,P{JU)C sat(Cj UCm„PU U), 



Note tint nc . all pairs C>/j and C>/^ are necessarily comparable. 
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Sidbe oif/come 1 is more preferable than outcome 6 (and in general lower numbers are 

le than higher) a partial order on responses by a plan checker to a plan has 

This is however only a partial order and so it can not be used to determine 

re8ij)n8e to a given plan. That depends on how the planning island to which the 

nds interacts with all the other planning islands in the overall plan space. 
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to use a sensor. 



the plan checker can not find a set C>/ with support{C,^) C P which ensures 



the plai wi work. In principle, the plan checker should search for a set such that 
suppor\\{C }j] 
of the [/vorlc 
howeviK, int 
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C P [JU and such that there exist sensors which can determine the state 

at plan execution time to within the accuracy required by C>/. Sensing, 

oduces new uncertainties and new nominal values. Therefore it is necessary 

the representation of the plan with sensing to reflect the new variable sets. 



riables must be introduced. 



figure 4. The world has an initial state. A sense operation is carried out. The 
d^ntrdler interprets the sense operation by choosing some nominal values for plan 
then the plan proceeds as in the simple case of figure 3. 



1 of a sensing operation is to choose new nominal values for named physical 
fit this with the variable and constraint formalism used here it is necessary 
n|w names for all sensed quantities. Thus for each named physical quantity 
8 in an expression describing a physical quantity to be sensed, a new plan and 
rariable pair must be chosen, 
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plan variable be BOX~SENSE-POS and let the new uncertainty variable be 
SEM$E-U1|C. The new representation of the physical quantity will be 



Since b[)th a 



Similar 
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must \[ :>ld. 

enso 
the robot co 



that in plan A it is decided to sense the physical quantity box:position. 
is represented by the expression 

BOX-POS -f BOX-UNC. 



BOX-SENSE-POS -f- BOX-SENSE-UNC. 

e representations of the same physical quantities the constraint 

BOX-POS -f BOX-UNC = BQX-SENSE-POS -f BOX-SENSE-UNC 



can be lassuifed even at plan time. Similar restructuring takes place when the quantity to 
be sen^M islnot a single named physical quantity, but rather derived from an expression 
m nani^d ph /^sical quantities, such as the area of the top of the box in section 3.5. 

4.2,2 4)pnsfcr iints implied by a sense operation. 

Retail Ifom section 3.5 an expression / which is the representation in terms of plan 
and u4|ferta(ity variables of a physical quantity to be measured, can be decomposed into 
the su^ of ii nominal expression and an uncertainty expression as 



y let -f- V be the expression in the original variables which it is replacing, where 

nor linal component and v the uncertainty component. Since the old and new 

epresent the same physical quantity, the constraint 



n -I- u = -f u 



(4.3.1) 



reading at execution time provides a nominal value for the expression n. I.e. 
itroller can interpret a sensor reading of m by assuming the constraint 

7''^ + W{ READING, }M <ri<m'\' H{ BEADING. }M- 
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not simply use the nominal value returned by the sensor as the nominal value 

n at plan execution time? There is a problem with consistency of multiple 

rHjadinfes. Since each individual sensor has errors in its measurement, if more than 

used to measure values for non-independent expressions then the nominal 

will usually be inconsistent if used as the nominal values for the expressions. 
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nom nal 



will be combined (also with constraints already known) and the robot 
choose consistent nominal values for all the plan variables P. 



at the robot controller will not use the nominal value returned by sensors 
not possible to use the sensor error characterization directly to constrain the 
e uncertainty of using a sensor. The analysis below proceeds as follows. P'irst 
)ossible sensor readings is characterized, then the possible interpretations of 
are characterized as in figure 4. From that an a priori uncertainty can be 



Firs t cor sider the range of possible sensor readings which might be returned. The 
actual ill^ysicll quantity a priori modelled by o-j-v must lie in the error range sensed. Thus 

^ + [U{ READING. }M < o + D < m-f [r^J^ READING. }(m). (4.3.2) 



replaced by a new plan variable READING^. At plan execution time an exact 
obtained for this plan variable. Recall that /., and r^ are expressions in 
n the above constraint becomes 



READING^ 4- /s < + V < READINGS + rg. 

value to be chosen for n by the robot controller ensures that 
READING^ -\-ls < n < READING^ + r« 

READING-, 4-/5 < READINGS + r^ — U 

READING^ 4- /^ — w < READING^ -j- r^ 
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(4.3.3) 



so thai. 



Recall 



TWls lajt constraint reduces the uncertainty u in terms of READING ^ which is itself 
constr^ ncd n terms of the original model by (4.3.3). Together with (4.3.1) this also 
constr;i ns tile possible range of n. 



the 
e.g 



In 
READINGI 
there ii 
suffice 
the unitertaii 



Ati 
it is th 
checkei 
a consistent 
makes 
First it 
checkei 
derived 



irst 
unc 
has 



: etter 



assu] les 



interpn; atioj 
constrai its tc 



by the 



4.2.3 T 



Le1, 



uncertafpty v 
when eiltiher / 



no m 

CO I 



\o 



Is — r. < u < r., — I, 



hat i 3 and r^ are expressions involving READING^ 
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(4.3.4) 



ecial case that the expressions Is and Ts are independent of the variable 
for a sensor that has constant error characteristics over its whole range) 
ed to introduce READINGs as a plan variable, and constraints (4.3.1) and (4.3.4) 
strain the possible values which will be chosen for n, and for characterizing 
ty u. 



ight (4.3.4) seems to underconstrain the uncertainty u. Recall, however, that 
rtainty at plan time in the derivation of n in terms of o, given that the plan 
10 knowledge of the algorithm the robot controller will use in determining 
et of nominal values. The implemented plan checker described in section 5 
use of the accuracy of available sensors by introducing three complications, 
that all constraints are "well behaved" in some sense and that the plan 
c etermine at plan time all discontinuities in the valid values for a plan variable 
1 sense operation. Secondly it plans sensing operations one at a time, with an 
phase interposed between any two of them. Thirdly it conservatively adds 
Cj which ensure that the robot controller can use the nominal value returned 
as the nominal value for the physical quantity being measured. 



ructured plan. 

2 P include introduced plan variables, and U^ D U include the introduced 
triables. Also include in P+ any variables READING., associated with sensor s 
or Ts included it in their supports. 
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net/ expressions associated with some of the named physical quantities in the 
goemefi||*y ^ df a plan [g,P,U,V,Cj,C,A,Cg) make it necessary to reconstruct the constraint 
C^. Let the new versions be Cj" and Cq. Their supports do not contain any 
n P and U associated with a named physical quantity which is in an expression 
will be sensed. Let g'^ be the geometry g, along with the new associations of 
nd named physical quantities. 
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be the set of constraints on the new variables which can be deduced at plan 
jnsor contributes either two or three constraints. A sensor with error dependent 
•|^adin ; contributes cpnstraints (4.3.1), (4.3.3) and (4.3.4). A sensor with independent 
ntril utes only (4.3.1) and (4.3.4). Clearly 
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support{Cs) C P+Ut/+. 



ructured part of the plan which follows sensing can now be written as 



P+ - (^+,P+,C/ + , V,C^C+,Ct) 



Cj U C5. Once constructed it can be analyzed and checked by the plan 
in almost the same nrianner as the original plan. 



f 



way in which the resulting plan must be treated differently from any other 
a constructed set of constraints C)j may not constrain any introduced plan 
he set P^" — P. The implemented plan checker described in section 5 actually 
f such variables separately, and constructs sets C>/ with support in the original 
cfcnstraints on the introduced variables are thus expressed in terms of constraints 
gin il variables. A formal notation for this representation has not been introduced, 
ts of clarity and brevity. 



iot controUor interprets multiple sensors. 

execution time the robot controller makes measurements using all the 
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T]i2 pla 1 checker sets the stage for the execution time sensor interpretation by con- 
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for va ious physical parameters, which will be used to carry out the planned actions. 



iilight 



C, a 



lii one 
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nsors. It then must interpret the values in order to choose a set of nominal 



et of constraints which must be satisfied by the new nominal values to be 
an variables in P+ — P, 

extension of previous notation needs to be introduced. Given a set of con- 
set of variables A and a point a G space(A), then 

[CU(o.) 



constraints C partially evaluated at the point a. 



L^H M be the set of all formal variables READING5, one associated with each sensor s 
to be li^ed. | Note that M and P "•" may have non-empty intersection.) Let C^ be a set of 
constriints Jf the form 

READINGS -{-Is <n < READING5 + r, 



such constraint for each nominal expressions n being sensed by sensor s. 



sider the situation at plan execution time. The plan variables in P already 

n|[jbina values assigned to them. Let p G Bpace(P) represent those assignments. The 

are s 1 read. The result is a point m ^ M. (Recall that the error characteristics of 

sensors j re encapsulated in the constraints set C5.) The problem then is to determine 

nom nal values for the variables in P+ — P, consistent with the sensor readings, 

coiji^traijts derived at plan time and the nominal values already chosen for variables in 



)t controller can find a set of consistent nominal values for all plan variables, 
I point 

p"^ G Bpace(P'^) 
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interpi";!tati( n of the sensors consistent with the existing constraints. 



4.2.5 SmsoT ' can checkpoint plans. 
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contai|j|s a p Int consistent with the values for variables in P, and the sensor readings, when 
searchfljig fo an interpretation of the sensor values. If such a point does not exist then the 
measuti1^,merts from the sensors are inconsistent with the model of the world. 



Le 



er ca 



proj{P^,P,p'^) = p 



E proJiP-^ U f7+,P+, sat(l [Cj U Cs U Cm1p(p) 1mM,P+ U t/+)). 

these two requirements simply says that the old nominal values for variables 
ained. The second takes into account the sensor readings and chooses an 



lat a sense operation has been introduced into a plan it is possible for the robot 
check that the sensor readings could possibly correspond to the model of the 
y the robot planner and the plan checker. It implicitly must do this in order 
.he sensor values and choose nominal values for the quantities being measured, 
checks whether 



sat(l [Cj U Cs U Cm]p{p) Im (m),F+ U C/+) 



pla 1 checker can arrange for the robot controller to do more however. The robot 
1 be told how to to identify which sensor readings are implausible in themselves. 



A|b| planltime the plan checker can include in P"^ a variable READINGs for each sensor 
s, ind^itendjnt of whether Ig and r^ depend on that variable, and include a constraint of 
the foilih (4.f.3) in Cs. Then it can compute a set Bs where 

Bs 2 proi(P+ Uf/+, {READING,}, sat(C2 UC5,P+ Ut7+)). 

Then i^ pla|i execution time when sensor s is read, and a value m^ is returned, the plan 
can be |ihecl|Ed by testing whether m^ 6 B^. If not, then the planned model definitely does 
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not fiti the c iirrent physical situation. Furthermore the identity of sensor s can give any 
error i|<icove y system a handle on where the inconsistency lies. 

4.3 VLov! adc itional constraints affect the plan. 



In 



n 1.2 six possible outcomes for a plan checking algorithm were outlined. That 
groupi|iKg wa \ somewhat arbitrary but the six outcomes are maintained here to explain how 
differeHI' pre perties of a computed set Cj^ can be used to characterize what can be done 

. The mathematical considerations in the characterization of the set Cj^ are 

le six outcomes below. 
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ihoul i be emphasized the the particular set C>,' computed by a plan checker depends 

^lan checker itself. Plan checkers difl'er in the extent to which they need to alter a 

assu|e themselves that it will work. Such differences can be compared if costs are 

to lossible alterations to a plan. The issues involved will not be addressed in this 



secti 
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it is 



he plan checker does. 



n checker is given ^ plan P. It computes a set C>/ of additional initial 
constrMnts 1 lat it deems necessary to guarantee that the plan is sound. If support{C}j) C 
inished and the final plan is 



(g,P,U,V,Cj[jC^,CA,Cg). 

e plan checker introduces sensing into the plan to derive plan P + . It then 
lew set C^ as before on the basis of P+ resulting in a final plan 
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sat{Cj U Cj^,P U C/) = sat(Ci,PU U) 
then tHb ordnal plan is the same as the new one, so in fact the original plan was sound. 
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If no sensing was introduced, support{C)j) C P and (A) and (G) hold then 
is sound and is simply the given plan subject to some extra constraints on 
ables. That is to say, some of the as yet unresolved decisions concerning the 
b( en further constrained. 



plal 

van 



ME 
x\bport 
:;ted 
iNpte 
C 
will 



stati 
lope 



nore, if 
rally 



Cu =0 



: Suppose sensing has been introduced, (A) and (G) are true for the new plan 
^i) Q P'^ ' Then the plan with sensing is sound. 

: Suppose sensing has been introduced, (A)and (G) are true for the new plan, 
C^) Z P'^', while s7xppor£(Cj) C P+ UC/+. In this case plan P^ should 
md the plan checker should back up to the original plan P augmented with 
suppori(Q)4) g P. Now the previous plan islands should be rechecked, 
U C>/ as a stronger goal constraint than previously supplied. Essentially this 
force sensing to be carried out earlier in the overall plan so that the propagated 
.hat reaches this plan island will be reduced. 



lat 



; If any of the above conditions are met, except that (G) does not hold, then 
is physically realizable except that it doesn't achieve the desired goal. The set 
s which can arise should be propagated forward to the next planning island, 
hat subsequent sensing and actions can be modified to handle the uncertainty 
J b this step of the plan. 

If none of the above conditions could be met (e.g. there are neither powerful 
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If sat{[Cj U Ca]u{Ou), P) = then the plan is unworkable independently of 
how nnlilich tie uncertaintites in the physical system can be reduced by sensing operations. 
The t^^^ sint)ly asks whether the constraints are satisfiable even with zero uncertainties. 
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operations available nor could the planning islands before and ahead of this 
ipted sufficiently) then the plan P is unworkable in the context of the global 
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The 



Ac RONYM (Brooks (1981a)) system used such a constraint manipulation system 

>ut consistent interpretations of image features. This section takes a constraint 

I system of the form used by ACRONYM and constructs an algorithm for 

! algebraic aspects of robot plans. It is capable of producing five of the 

ouWtomei previously detailed. In particular it propagates constraints forwards and 

ongst planning islands, it introduces sensing operations when necessary and 

and when a plan is rejected it gives some analysis of what is wrong with the 

^xtenping it to include the sixth possible outcome (outcome 4) is straightforward, 

extrl complexity detracts from the presentation of the algorithm. 
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in Algorithm For Dealing with Position Errors And Toleranced Parts 

heart of a plan checker there must be a system which can reason about 
about their satisfying sets, and about the projections of those satisfying sets 



5.1 introduces some more notation concerning satisfying sets of sets of con- 



5.2 details the fornrial properties of the constraint system used in the plan 

known as the SUP- INF method. These properties are precisely those needed 

checker developed through the rest of section 5. Any other constraint system 

operties could equally be used as the core of the plan checking algorithm. The 

of the constraint system (and hence the algorithm) is not formally addressed. 

system used here is understood formally when restricted to linear sets of 

However for non-linear constraints the best characterization known so far is 

empirical. Section 4.3 discusses the issue of comparison of performances of 

algorithms. 



3.3 introduces an important sub-procedure. It projects a set of constraints 
into a ^Jibspj ce, over the satisfying set of a second set of constraints. This procedure is the 
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workho rse f( r constructing sets C>/. 

Sdction p. 4 describes the main plan checking algorithm based on the SUP -INF method. 
Sectioiil 5.5 dfctails how the SUP -INF method can be used to decide which physical quantities 
need t^ be & used, and section 5.6 gives a detailed example of the plan checker on the four 
couple|[| plarfc introduced in section 2.2. 
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ation. 



straint methods used at the core of the plan checking algorithm described in 
sections rely on estimating bounds on expressions over satisfying sets of sets of 
some additional notation is convenient in order to characterize their behavior. 

: Given an expression e, and a set of constraints C, let W = suppori(e) U 
et S = sat{C, W) then deHne 



/u6(e, C) = sup[e]vv(p) 
pes 



is the least upper bound on the values achieved by the expression e over the 
of the constraints C. The greatest lower bound glb(e, C) is defined similary. 



com )utational tools. 



Bhdsoe 1975) introduced what he called the SUP-INF method, to determine whether 
sets of Jinea equalities had integer solutions. The problems he wished to solve arise in 
automii|tic gineration of proofs of correctness of programs using methods of inductive 
assertiois. S lostak (1977) extended the method and showed that it was equivalent to the 



od over real linear inequalities, 

hor (Brooks (1981a), (1981b)) extended the SUP-INF method to handle a 
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class 



f non-linear inequalities, and included simple extensions to handle certain 

elemei|i|ary functions (e.g. sin and cos) in a primitive way. To support an implementation of 

an checker, the author had to extend the method further to handle disjunctions 

c||jalitities and conjunctions of inequalities. It already implicitly handled simple 

of inequalities. As a by-product of this development it became possible to 

a mlcli fuller treatment of quadratic forms. 
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Tiis se ;tion describes the computable functions of the extended SUP-INF method, 

irizcs their capabilities. The precise algorithms used in the earlier versions of 

rr 3thod can be found in Brooks (1981a) and Brooks (1981b). 
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S£ ons handled by the extended SUP-INF method can include operations for 
)traction, multiplication, division, square root, maximum, minimum, and (to 
t) some trigonometric functions. Operations are on numbers, the special 
^ oo ind — oo and formal variables. 



ete 
ine( 



ex bent 



Coiiside 



Ccnstrjnts are inequalities and conjunctions and disjunctions of constraints, 
can arise from simple inequalities if MIN is placed on the left of "<" or MAX 



Disjunldttion 
on thd right 



5.2.1 lh)und ng with projections. 



'-INF method takes its name from two procedures, SUP and INF which bound 
ver satisfying sets of constraint sets. In general they do not provide the best 
ids, but in many cases (linear for instance, see below, but also often otherwise) 



:al Y the symbolic result of SUP will be an expression of the form min(ei, . . . , en) 
while Me reiilt of INI^ will be of the form max(ei, . . . , £«). 



as an example the set of constraints defined by 
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Cf ~ {x X X < y,a; + 2/ < 7}. 



Then blie pi )cedures SUP and LMF produce the results: 
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SUPC'x + y'\ Cf , { y }) = inin(7, 2.1926 + ?/, y -[- y/y) 



INF{"x",C£,0) = -3.1926 

procedures take three arguments. First consider the following special case. 

expression, C a set of constraints, and suppose that support.{e) C support{C). 

(1981a) shows that 

luh{e,C) < SUP(e,C,0) 

glb{e,C) >INF(e,C,0) 
is satisfiable, i.e. whenever 

sat{C, support(C)) j^ 0. 

No gu^antej is made concerning the results returned by SUP and INF when the constraints 
are 



sati? iable. 



ir sets of constraints the extended versions of SUP and INF behave identically 
5hostak (1977). He showed that under those conditions they actually find 
be^|; poK ;ible bounds. That is for a constraint set C which consists entirely of hnear 
md a linear expression e then 



/u6(e,C) = SUP(e,C,0) 

^%,C)=3lNF(e,C,0). 
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10. 1 n illustration of tho projection and bounding behavior of the procedures SUP 
'. Tie text contains detailed commentary. 
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SUP(e,C,{y}) 




H{x.y}M(C,{a:,y})) 



so-t(C,{x,y}) 



res SUP and INF are more general however. Given a satisfiable set of con- 
xpression over the satisfying set, and a subspace, SUP and INI'" compute sur- 
over the projection into the subspace of the satisfying set, which everywhere 
pression over the inverse image of the projected points in the original satisfying 
mally, but perhaps more clearly, suppose support(C) QW^VC W, and e is 
1 where support{e) C W. If 

sat(C, W)^(li 



support(SlJP{e,C,V)) C V, 
support{mF(e, C, V)) C V 



V.sat{2,W), (5.2.1) 

l^pP{i,C,V)]v(proj{W,V,x)) > le]w{x) > mn<'.C,V)]y{proj{W,V,x)). 
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5.2.2 A 
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of 



part-.l 



gives an illustration of these capabilites. There the set W is defined by 
, and V ~ {y}. The constraint set C is satisfied by the region shaded in 

. The expression e takes values in the reals 9? over the satisfying set and 
he surface patch illustrated. The darkened region of the 7/-axis illustrates the 
the satisfying set sat{C, W) into space(V). The shaded region in the y~^ plane 
s )onding projection of the values achieved by e. The curves in the t/~9J plane 
low that shaded region correspond to the values achieved by the expressions 
SUP(e, C,K) and INF(e, C,V), both expressions in y, over the porjection of 

1 set. Notice that they are upper and lower bounds on the projection of the 
I generated by e. 
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al decision procedure. 



p pre ccdures SUP and INB' can be combined (following Bledsoe (1975)) to produce 

decision procedure on sets of constraints. The decision concerns whether a set C 

con^tirainft is consistent, i.e. whether the constraints are satisfiable, or formally whether 

sat{C, support{C)) y^ 0. 

That i^e procedure is partial comes from the fact that it can not always decide whether 
or not this i| the case. In fact it has two outcomes; one that the satisfying set is definitely 
emptyj and Ithe other that it doesn't know. This property is the cost of requiring that 
it a]w^i[s tei minate in some bounded time determined by the size and complexity of the 
constraint s( b C. 

Tj 3 dec sion procedure is called DECIDE. Given a set of constraints C, then if 

^vesupport{C),mF{v,C,0) < SUP(t;,C,0) 

(where the ( efinition of "<" is extended to handle ±oo correctly) DEC]DE(C) returns 
"possipy sa\ isBable" (or true), else it returns "definitely unsatisRahle" (or false). 



edure DECIDE is sound in the sense that it never returns an incorrect result. 
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' characterization of the extended SUP -INF decision procedure is empirical, 
n its use in the ACRONYM system there was never a case observed where 
etect an inconsistent set of constraints. However it is possible to construct 
f coittraints which is in fact inconsistent, on which DECIDE returns "possibly 
The philosphy adopted in ACRONYM was that if there was a failure to detect 
ncy at some point in the computation, it would more than likely be detected 
tnplications of the inconsistency were propagated and became less subtle. 



Gi^ien 



the 



(Ci) 
Ion of 



i;r th 



from the fact that SUP and INF return upper and lower bounds over the 
of a set of constraints. 



le a procedure which always returns "possibly satisfiable" is also sound under 
of soundness. Such a procedure happens to be worthless, however. A partial 
edure is only interesting is it sometimes detects unsatisfiable sets of constraints. 
,en it successfully detects such sets, the more interesting it is. 



sub-procedure. 



Bcifeidcs DECIDE, another important sub-procedure used in the plan checker is 
PROJOS. It projects a set of constraints into a subspace over the satisfying set of a second 
set of Idpnstjaints in such a way that points which satisfy the projected constraints also 
satisfy Ihe oliginal constraints. Essentially it tries to find prismatic subsets of the satisfy- 
ing set :tf the first set of constraints, with elongation orthogonal to the projection subspace, 
which ak wloUy contained in the satisfying set of the second set of constraints. 



vjiriables sets W and V where V C W and constraint sets Ci and C2 where 
C W and support(C2) C W, the procedure PROJCS simply computes the 
Ci from space{W) to space{V), over the satisfying set of C2, by 

,^,Ci,C2) 

»(fl, C2,V)< INF(6, C2, Vr I "a < 6" 6 Ci, SUP(a, C2, 0) ^ INF(&, C2, 0) }. 
contains conjunctions or disjunctions then PROJCS simply maps this projec- 

terms. Thus PROJCS is a computable procedure which returns a set of 
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The sot V supports those constraints. The comparison of the numeric upper 
unds of a and 6 respectively simply serves to prune out constraints which are 
over the satisfying set of C2. The key property of procedure PROJCS is given 
lemma. 



, C = PROJCS(VK, V, Ci, C2). Then 

5ai(CUC2,l^) C sat{CuW). 

X G sat{C U C2,14^), and let a < 6 where a and b are expressions in W be a 
Ci which is not trivially satisfied over sat{C2,W). 



z sat{C2,W), then by the definition of function SUP (see (5.2.1)) 
[a]w{x) < \SVF(a,C2,V)]v(proj{W,V,x)) 



lmF[b,C2,V)]v(proj{W,V,x)) < {b]w{x). 
3, W) also and hence satisfies every constraint in C. In particular C includes 



SUP(a,C2,V) <1NP(&,C2,V) 



[a\w{x) < lb]wixy 



sat{CuW),U 



ri^l^ pro|:edure PROJCS often results in a set of constraints whose satisfying set is 

a disjunction of sets satisfying subsets of the constraints. This is because 

nequalities by putting expressions produced by INF, which includes "max" 

n the right of "<" symbols, and expressions produced by SUP, which include 

min" j^^pre|sions, are put on the left. 

62 
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s given an initial state of the world and it propagates the effects of actions on 
CHECK, through the plan steps while constraining the plan variables so 
ns are guaranteed to succeed. Whenever a plan step is reached which can not 
d to work by constraining plan variables or sensing at that step of the plan, 
ner backs up, again using CHECK, carrying back a set of goal constraints 
here CHECK can guarantee that the goal can be satisfied. It then proceeds 
aga n from that subplan aplying CHECK and propagating the results. 



pi mi 



:!arly 



plan 



whic] 



1 checker must check a sequence of subplans at a particular level of abstraction. 

CHECK is defined later in this section which checks individual subplans, or 
t nnust be used by a higher level plan checker which typically would be part 

robot planner. In this paper we assume a simple model for the plan checking 

robot planner. 



>cess is illustrated below by checking the four plans A through B introduced 



there is room for much work on the role of the robot planner and the nego- 

whijh can take place between adjacent planning islands. This paper has not directly 

addre^fed tHat issue, as it is more properly part of the planning process itself, rather than 

:hecking per se. What this paper has done is to give a mathematical framework 

those negotiations can be explored. 



checking. 

1 defines the procedure CHECKSIMP. It is the part of the plan checker which 
• a plan can be guaranteed to work simply by constraining the plan variables. 



its arlument list P is the plan to be checked and P* the plan which follows it in the 
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procedure C :iECKSIMP(;', .P*,FEEDFWD) 



begiQ 



if not 
: ion 
tsLse 



end 

Figure 
constriilined. 
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In that 
not 
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THEOl^ EM 



IS sounc 



PROOF 



Sin:e 



DECIDEdCj U CaVA^u)) 
c utcome 6 

>egin 

Cj^ <-PROJCS(PUC/,P,C^,Cj) 
U (if FEEDFWD 
then 

else PROJCS(PUC/Uy,P,C*j,CjUCp)); 
if DECIDE(CjUCa/) 
then 

begin 

if FEEDFWD then PROPAGATE(P*, Cj U C.v U C^); 
return outcome 1 
end 
else return other 
md 



1. F rocedure to clieck whether a plan will work if its plan variables are sufficiently 



rthe 
case 



^ plaining islands. A flag, FEEDFWD, says whether the initial states of the following 

shotld be used as a goal condition (when the flag is false) or whether the initial 

following plan should be derived from the current plan (when the flag is true). 

L procedure PROPAGATE is called to update P. Details of that procedure are 

d here. 



f procedure CHECKSIMP produces outcome 1" then the plan 



It SI ffices to show that conditions (A) and (G) hold. 



Q\ was computed by procedure PROJCS the lemma of section 5.3 says that 
sat[Cj [jCu,P\jU)C sat(CA,P U U) 
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n illustration of the various constraint sets and their satisfying sets involved in 
ient constraints on plan variables to guarantee that a plan will succeed. The 
c<t)liitain i detailed comnmentary. 



12. J 
suffi 



con( 
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Cf 



sat{Cj[UCg,PUU[jV) 




sat{CjUCj;,P\jU) 



C^ Constraints C>/ 



U 



ition (A) is proved. 



f"EEDFifD was true then the theorem is proved. Otherwise the lemma can again be 
)hsh that 



3at(Cj UCg[jCj^,PUUUV)C 3at{C],P\J U U V). 



and U* CU\JV whence condition (G) is satisfied. 
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tion tries to give a more intuitive explanation of what is going on in construct- 
raints Cj^- above. Consider figure 12. 

licity (and drawabilty!) the sets P, U and V have been compressed to single 
addition the axes have been offset so that they don't go through the zero values 
n U and V. The large region outlined in the P-U plane is sat(Cj,P\J U) 
initial states possible for the original plan. The region in the P-V plane is 
t/*). Note that in this case P ~ P* and F = t/*. The smaller region in the 
the region where the action of plan P is applicable ~ i.e. sat(Cr\jCj^^P\jU). 



floating above is the set of states which the action can achieve when applied 

tate. In this diagram there is only one resultant state per initial state, so that 

resented by a function. The surface patch is given by sa^(C2UC^,PUt/UV'). 



Tlji|3 roll of procedure CHECKSIMP is to further restrtict the set of initial states to 
where Utie ac tion is applicable and to where the resultant final state will project into the 
set of itiliitial states of the following subplan P* . 



wishful thinking (see section 4.2) the cross section of the new set of initial 

e identical in the U direction wherever it intersects the original set. This is 

:annot change the initial uncertainties purely by legislation — sensing must 

if that is desired. Therefore the only constraints allowed in this diagram are 

P, a|id so they must be parallel to the tZ-axis. 



Coiiditic [1 (A) says that the initial states should be confined to be a subset of the points 

4tisfy|C^. Condition (G) says that the initial states should be confined so that the 

states above them projects into the initial set of the following subplan, in 

le in this case. The dashed lines give constraints C>/ which guarantee that 

onditij)||is (A|) and (G) are satisfied. 
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13. T le main plan checking algorithm. 



( HECKSIMP(P, P*,FEEDFWD)of 
1 3turii outcome 1; 
I 3turn outcome 6; 
r: begin 

Cji/ "»- C^ U (if FEEDFWD 
then 

else PROJCS(PUt/Ul^,PU[/,Cj,CjUC.)); 
S 4- SENSEVARS(Cj,Ca/,P,[/); 
P+ ^RESTRUCTURE(;',s); 
case CHECKSIMP(;' + , ;'+*,. true.) of 
1: return outcome 2; 
6: return outcome 6; 
othen-if PROPBACK(P,C>/) 
then return outcome 3 
else return outcome 5; 
endcase 
end; 



5.4.3 Fill sc'c \e checking. 



plan 

be g 

k to i 



We 

5 b^ow 
the 

, an 



IECK(;',;'*, FEEDFWD) 



1 } gives the main plan checking algorithm. It uses CHECKSIMP to check the 
and simply passes on the result if the plan either fails to work completely or 
laranteed to work by simply constraining plan variables. Otherwise CHECK 
itroduce sensing into the plan to see if that will help. 



lets a new set Cm, using PROJCS as does CHECK, but this time its support 

I ricertainty variables from U. It calls a procedure SENSEVARS described in 

to decide which of the uncertainty variables need to be reduced by sensing 

ew constraints C>/. SENSEVARS returns a set of physical quantities to be 

1 associated sensors to do the measurement. 



pro<|edure RESTRUCTURE is invoked to carry out the operations described in 
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restructure the plan P by introducing new plan variables whose values will be 
at plan execution time by interpreting the chosen sensors. (Section 5.5 below 
practical simphfications which can be made to the constraints of section 4.2. 
ations are not approximations, but rather conservative estimates which result 
er constraint sets and thus less computation time. Their drawback is that in 
ations the plan checker may reject a plan which is actually valid.) 



pr )cedure CHECK invokes CIIECKSIMP again to check the restructured plan, 
flag is passed true, so that subsequent planning islands will be restructured for 
ing variables. If CIIECKSIMP says that the restructured plan p-^' is sound 

is done and by the theorem above the plan with sensing is sound. Otherwise 
e PROPBACK is invoked. It recursivley re-invokes the plan checker on the 

already checked) plan, with FEEDFWD false, to see if it is possible to deliver 
plan P in a state where the uncertainties meet the constraints Cj^. Of course 
CHECK on the previous plan may again result in PROPBACK being invoked, 
ccrusive calls of CHECK back through the chain of plans. If that recursion 
he PROPBACK returns false and procedure CHECK gives up by signalling 

PROPBACK is successful then Cj^ defines a new plan which is again sound 
3 is the result. Examples of the behavior of PROBACK are given in section 



nple. 



tion CHECK is called on each of plan A through plan D succesively, with 

so that the initial constraints of the following plans are generated. Section 

e initial states for plan B which had been generated from plan A. In that case 

in CHECKSIMP produces no new constraints, as the constraint from 



to P tOJCS 



isified. 



12.0 < BOX-POS < 36.0 
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B generates no new state informatioD. Finally plan C generates initial constraints 

12.0 < BOX-POS <36.0 
e<(BOX-P0S)< BOX-UNC <e/,(BOX-POS) 
e<(BOX-P0S)< LID-UNC <e,,(BOX-POS) 
ei(BOX-P0S)<BOLT-UNC<e/i(B0X-POS) 

6^(2;) = max(0.0002215x - 0.043262,0.0009857a: — 0.063329) 
eh{x) = min(0.043262 ~ 0.0002253a:, 0.063329 - 0.0009895:c) 
gain PROJCS generated no new constraints in this case. Note that 

P={ BOX-POS } 

U ~{ BOX-UNC, LID-UNC, BOLT-UNC }. 



tie 



'iinge 



Th;; pi 
RESTIiUCltjRE 
sensing can 1 
the prcijjedur 



qilECK is applied to plan D the first call to CHECKSIMI* fails with outcome 

reason, although the plan checker can not isolate it to this level of analysis, 

bolt and the lid line up well enough for initial insertion, there is too much 

n the relative positions of the box and lid to guarantee that the holes in 

. A new set C>; is computed where support{C)j) C P\JU. The procedure 

is invoked and it deduces that BOX-UNC and LID-UNC have smaller ranges of 

C}j constrains the intital states (SENSEVAKS is described in more detail in 

). It correctly deduces that there is no need to reduce BOLT-UNC anywhere 

)f box positions. 



m is restructured to introduce sensing. However the procedure 

notes that no named physical quantities are introduced in plan D, so 
ot affect any action which is to take place. Therefore it immediately invokes 
I PROPBACK. It propagates the set Cj U Cj^' back to plan C as the initial 
plan D, Thus when CHECKSIMP is invoked on plan C with flag FEEDFWD set 
realized that plan C needs to produce a more tightly constrained world state 
\gain SENSEVARS is invoked and it recommends reductions in the ranges of 
ID-UNC. 



lu: e RESTRUCTURE is once again invoked. It decides that since there is only 
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further 



)v ph sical quantity to be introduced, namely boit:positlon, and since it depends 

lid:]. DSitlon, then it can only possibly help to sense the latter, and thus it can only 

hell to reduce the uncertainty in the position of the lid and not in the position of 

. Seising is introduced, and then PROPBACK propagates forward from the new 

f,o pi ,n D once again. However plan D once again fails as the relative positions of the 

lid lave still not changed, and so there is no guarantee that they will hne up well 

for he bolt to be inserted through them both. Therefore PROPBACK continues 

up i -om plan C. The result is described below in section 5.6. 
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ng sensing. 

5.4 described procedures to check plans. A major subprocedure invoked by 
SENSEVARS. Its job is to select physical quantities and sensors to be intro- 
plan to guarantee its success. There are two stages to that process. First 

ities which must be reduced by sensing need to be identified. These can be 

)y examing the set of new constraints C>/. The prcoess is described below. 

tep is to choose sensors which will indeed reduce those uncertainties. 

g what needs to be sensed. 



figure 14. The outlined area in the P~U plan is the original set sat{Ci,P[jU). 

shaded Jtjbset of that area corresponds to sat{Cj[jC}j,F[jU), For a given value of the 

riable in P a piece of the original set which is unshaded represents a tightening 

5 on the single uncertainty variable in U, In general it will be necessary to 

identifi^ whicfi uncertainty variables are so constrained. 



an uncertainty variable u ^ U and the problem of deciding if it has been 
Iconsirained. Let 

o,^SUP(u,Cj,PUt/~{u}) 
o^^mF{u,CJ,FUU-{u}) 
ris = SUP(u, Cj U C.v,P U U~{u}] 
n, =r INF(u, CjUC^,PUU-{u}), 
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Os and Oj are the original bounds on u, (expressed as functions of the parts of 
c(rthoJonal to u) and rig and n^ are bounds on the newly constrained u. 
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\'^s]pUU-~{u}{x) < [Os]pUU~{u}[x) 

[nt]puu-{u}{x) > {ot]puu~{u}{^) 



(5.5.1) 
(5.5.2) 



e remainder of this analysis only Og and n^ will be considered. Dual statements 
nd Oi, 



rmine whether condition (5.5.1) were ever true it would suffice to examine 
see if it were ever positive. However Og and n^ will typically be expressions 
in" and thus their difference will be too complex for the SUP -INF method. 



S jppos however that ria = min(7Zsi, ^s2, • . • , risk)- Then if for any e > one of the 



C = CjU{u> n^y + c} 
then condition (5.5.1) is satisifed. 



Tljerefcjre the algorithm SENSEVARS simply chooses some small e and for each u 
applied pro(fedure DECIDE to each set of the form C above. If at least one of the sets 
be possibly satisifiable then u us a candidate for reduction. Note that if for 
ets are said to unsatisfiable by DECIDE then (since DECIDE only says sets 
able when indeed they are unsatisfiable) u has nowhere been reduced by more 
ipace(PUt/~-{u}). 



the ( sample of sections 5.4.4 and 5.6 a constant e of 0.000001 was used. 
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5.5.2 Choos ng a sensor. 
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e uncertainties are to be reduced by sensing have been chosen, it is necessary 
some geometric reasoning to find which quantities can be measured in order 
ose particular uncertainties. Each uncertainty is associated with a particular 
cal quantity in the geometry g of the plan. A quantity which can be sensed and 
ds on that named physical quantity must be found. That topic is not covered 



candidate sensor has been found it would be advantageous to determine im- 
measurement error is small enough to provide the desired reduction in uncer- 
re that one candidate sensor is found then this capability would be even more 
le SUP-INF method proves useful in this task also, but more work remains to 
he topic and meanwhile a useable plan checker can be implemented based on 
method without this capability. 



g the constraints. 



1.4.2 defined the constraints which can be inferred from adding a sense opera- 

inf:|j) a pjin. Those constraints contain many variables and an equality. Such constraints 

SUP-INF method significantly, making the analysis of a sensing operation 

turns out however that a set of simpler constraints, essentially projections of 

ms into a subspace, are almost as strong as the originals. Thus it is possible 

i spent in plan analysis for the possibility of missing a correct plan when all 

re extremely tight. This exactly what the plan checker implemented by the 



Mditfon the implemented plan checker assumes that the robot controller will use 

^alue returned by a sensor as the new nominal value for the physical quantity 

The validity of such sensor interpretations depends on the ability at plan 

e to be able to split up a satisfying set of Cj into components where the 
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e notation used. A physical quantity represented by the expression o -\- v, 
support in P and v has support in U, is to be sensed and to be represented 
^xprfjsion n-\~u where n represents the nominal value and u the uncertainty. The 
plan checker introduces the following three constraints. 

n -f ls{n)<o -f SUP(t;, C;, support(o)) 

o -f INF(?;, Cj, support(o)) <n i- rs{n) 
h(n)< u <rs{n) 
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two are an expression of constraint (4.3.1) projected into a subspace of plan 
e projection is conservative in the sense that anything that satisifies these two 
ill also satisfy (4.3.1). Thus the plan checker will have more situations to deal 
5ht have been described by using the more exact constraint. Since no explicit 

is introduced, but n is used directly instead, these two constraints also express 
5iven by constraint (4.3.3). The final constraint concerns the uncertainty in 
qi antity, and it takes the place of constraint (4.3.4). 



t lat 



the first two introduced constraints allow n, the new nominal value, to 

range of values than o, the older. Practically this often means that some 

jwly expressed in terms of n, will cut down the allowed range of values for 

nds up having the same range as did o before the sensing constraints were 

, is this process which validates the use of the nominal sensor reading as the 

for the quantity being measured. 

g the example. 

again the example of the four coupled plans. 



reacting the introduction of sensing at the start of plan C the procedure 
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works back through plan B and plan A. At plan B it notices that no new 
itities are introduced, so sensing can not help. The extra constraints request- 
in the uncertainty of the box and lid positions are carried back to plan 



SENSEVARS suggests that the box position should be sensed. Since 
physical quantity iidrposition depends on box:position the procedure 
IE introduces sensing for that quantity. 



new constraints are propagated through theseries of plans using procedure 
. Extra constraints get added to the new plan A to ensure that the nominal 

sensor can be used as the nominal value of box:position. For instance when 

s error characteristics 

~/,(m) = r^im) = 0.0004 X m 



traint 



12.0454 < BOX-POS < 35.9579 



extra constraints C>/ are needed until plan D is reached. The final subplan 
constraints on the plan variables (the initial nominal position of the box, 

only plan variable), depending on the error characteristics of the sensor. The 
e summarizes some results. 



-ion /, 



)35 X X 
140 X X 



145 X X 



50 Xjc^ 
X X 



Function r. 



0.00035 X X 



0.00040 Xx 
0.00045 X X 
a00050_X_£ 
0.00055 X X 



Resulting C>/ 



empty 



BOX-POS < 20.0892 V 28.1397 < BOX-POS 
BOX-POS < 15.6811 V 30.7618 < BOX-PO? 



BOX-POS < 12.8564 V 33.9237 < BOX-POS 



unsatisBablG 



>rs, with linear error, smoothly degrade the range of initial box positions which 
iccess of plan D. With an error factor of 0.00035 the plan can be successfully 
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atter case when the plans are propagated forward from plan A with sens- 

to plan D, the plan checker finds that the set C.v computed by procedure 

CHEOKSIMP leads to no feasible initial positions for the box. There is nowhere left to 

t ickwards from plan A so it must conclude that in this case the sequence of 

isible due to inadequate sensing. 



propagj, 
plans 



Lil 
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infe 



out 
regi 
er 
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wherever the box is initially placed. For 0.00040, 0.00045 and 0.00050 the 
n of the working area of the manipulator is forbidden, as the combination 
or and manipulator uncertainty makes the plan infeasible. If the only sensor 
an error factor of 0.00055 then nowhere is sensing powerful enough. 
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6.1 Pl^^nin ;. 

Mt^st vjark on planning has been restricted to abstract domains where there is little 
notiont bf a Inetric, let alone spatial relations, errors or tolerances. 
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6. Related Questions 

per has developed a formal model for checking robot plans. To do so it first 
formal model of plans. Plans are the result of planning. The plan checker is 
fy plans, but there has been no development in this paper of the formal process 
Thus there are some deficiencies in the model of plans used. Work is needed 
the model presented here with more creative planning processes. 



Siibsmali's (1975) HACKER program works entirely in an abstract blocks world. 

1977) Noah is not restricted to the blocks world, but every problem descrip- 

a procedural semantics of the domain to accompany it. The user really needs 

solution in advance in order to decide the form of the semantic description. 

1) MOLGEN works in a domain of planning molecular genetics experiments, 

't even have a strong notion of quantity. All these programs concentrate on 

t in a domain with impoverished semantics. The semantics of their worlds can 

specified in a few lines. They plan within that very simple world. Many 

ideJs are useful for robot planning, but one should not suppose that any of these 

ai i capable of producing plans that could possibly work in a real world. 



Jte y 



STRIPS sytstem (Sacerdoti (1974)) is often cited as a real world robot plan- 

stemi Indeed, a physical robot, Shakey, was controlled by plans generated by 

However, Shakey was restricted to a tightly controlled environment, and 

J^refiJ engineering ensured that the world was relatively benign. Errors that the real 

htroduced were handled by having the complete planing system available at execu- 

Planex) to modify the pre-computed plans. As such, this is an excellent 

untime processing power makes it viable, to handle deviations in the modelled 
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FMhlma a's (1973) BuiLD system, incorporated three dimensional models of objects 
cks world. Uncertainties of size and position ((1973) p. 48) were ignored as an 
[cation to be tackled later. Fahlman did however deal with objects touching, 

it^ and Irictional forces. BuiLD is capable of impressive behavior in the face of complex 
arrangements of blocks where these forces are significant. Fahlman claimed that "80% of 
nee" of his system derived from the level of detail in the model it was given of 
situation, while the remainder came from the planning knowledge embedded in 
Further, he claimed that the planning aspects are greatly simplified by having 
models. His system is probably unable to deal with real-world problems, but 
oser than the other planning systems mentioned above. 



the pei form 
a partifpular 
the sy 
the detailed 
it is 



plannijiKg 
power 
due to 
and to 



tem. 



Tfl^lor 
to 



il nu 
Tayl 
eran< 



that encountered in the real world. It has the disadvantage of the execution 

turning into somewhat of a "hit-and-miss" affair, where the models are not 

idequate, so a cycle of "action, sense, new action to achieve the same goal", 



m.ich 



^[:)rave ; (1980) programmed a mobile robot to navigate through a cluttered environ* 
ment using a visual map. It took into account errors and their effects at many stages 
of its comp itations. Because of its simple model of the world as clusters of points with 
knowr thre< space coordinates it had to be very generous in enclosing them with spheres 
to be y|void< d. It had a self model of how commands to its motors would alTect its three 
dimensional location and orientation. This model took into account frictional forces, and 
errorsj but llways assumed worst case errors to analyze the possible outcomes. Features 
that W<tire lolated by its nine eyes were also considered to be prone to error. All of Moravec's 
compt|)tatioi|s were of the form of propagating errors forward, then checking the result. 



197G) has carried out by far the most realistic analysis of errors in robot 
date. He used some symbolic geometric reasoning techniques, and many 
Tierical techniques. The example in section 2.1 of this paper is originally 
>r. His work differs from that here, in that he essentially propagated errors 
es numerically forward through a physical situation, then checked at the end 
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le mithods presented in this paper have their roots in Taylor's work. Instead of 
nnputation in one direction, the computation (of the constraints) is symbolic; 
tions can be proceed in any chosen direction. 
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and Popplestone (1975) and Popplestone, Ambler and Bellos (1980) have de- 
issembly programming system which has many elements of planning in it. 
)metric models of objects and infer spatial locations and orientations of parts 
ships between them (e.g. "against" or "fits"). They do not take into account 
instead work with nominal representations of distances and angles. Within 
the fribewdrk of this paper much of what they do can be characterized as finding con- 
an variables. 
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:ib detfejls of how the implemented plan checker propagates information from plan 
island, and exactly how it might fit in with an automatic planning system 
at extent ignored in this paper. That is largely because there are many ways 
such plan checkers with planning systems. 



agr 
ate 



invalid. Ii 



on 
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ilan 
at 
the 

pre 



compi 



I things as applicability conditions were met. If not, the plan was either rejected 
it the point where the applicabiity condition was violated (e.g. initiate a spiral 
force sensing to find the hole for the screw to fit in). 



m of planning and checking. 



hecker such as presented here could be integrated with a robot programming 

a number of different levels. The programmer might be required to model 

uncertainty effects of each individual motion command, along with providing 

•onditions on the applicability of that motion. The plan checker could then 

e^^ry r lotion command as an individual plan island in a sequence of planned steps, 

(|s vafldity and propagate the uncertainties to the next motion command. Like a 

er it could provide error messages about why the sequence of motions might 

a higher level robot programming language which included geometric models 
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automatic planning system culd also benefit from the plan checking approach 

this paper. Both Lozano-Perez (1976) and Taylor (1976) have discussed 

ems which expand skeleton program fragments into complete robot programs 

to account the constraints implied by the geometry of the particular world 

n there are decisions to be made in fleshing out such skeletons which must 

interactions. The plan checker presented here could be used as such a decision 

same time it can be used as the "test" part of a "generate and test" approach 

pjnner might use for decisions which its expertise gives no guidance. 



forn 



one w|)uld 
aecisiDn 



alk i 



ator and objects in the world, applicabihty and geometric constraints could 
automatically by examing the motion statements. Again, advice could be 
human programmer concerning critical points in the program where sensing 
or new motion commands were required. 



' system of Popplestone, Ambler and Bellos (1980) takes over some of the 

n|fe bui den from the human programmer. From the discussion of the previous section 

it much of what the plan checker does is in the spirit of the RAPT system's 

planning by solving relational constraints. It seems that a plan checker 

framework described in this paper could be naturally built on top of Rapt. 



of constraints. 



;; con straints 



used in the implemented plan checker are all algebraic inequalities. 

like to iind ways to express much more geometric constraints and develop 

procedures that could deal with them in a manner adequate for using the 

if plajs presented in this paper. The algebraic constraints used to date, constrain 

parame(^ri24ions of, essentially, "topologically" equivalent situations. They give no hint 

bout classes of states whose members include radically different topologies. 



The moc il of plans (but not of sensors) given in section 3 is independent of the variables 
being r^l-va ued or the constraints being inequalities. This gives some hope that it may be 
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possibli! to 6 ttend the plan checking formahsm into the area of geometric checking, besides 
the tm purely algebraic aspects presented here. 

6.4 Suiiimai^. 

Tlllis pafcer has concentrated on the algebraic aspects of robot plans that include explicit 
modeiy of ui certainties in the physical world. Earlier work (Brooks (1981a)) has shown how 
to maU frorr the geometry of a world model to the algebraic aspects studied here. A formal 
model ||>f ph ns was developed, and a formal model of a plan checker followed. The details 
of impllemer bing a particular plan checker were discussed, and it was shown that the plan 
checker couil check the plan, constrain certain decisions and introduce sensing in order to 
ensure! that the plan would work. 
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Appendix 

imple introduced in section 2.2 and referred to throughout the paper has been 

m implemented plan checker. The plan checker runs on a Lisp Machine at the 

illigence Laboratory at the Massachusetts Institute of Technology. Below is 

specification to the checker which describes the four coupled plans. This 

g^jierat^d by hand, but in the future may be generated as the product of a task level 

tem. 



Artifi(t lal 
l.he i 



ann]]ig sy 



Fii-st t 
declared 



intern] 



POSIT] i:iN en 



be ANGI 



eamnple 



(INITLILIZE 



(NPQDEC 
(NPQDEC: 
(NPQDEC; 



There 
manip 



(FUNDEF 
(MAX 

(FUNDED 
(MIN 



TL^ 



In ;( 



1 put 



I vari abl 



E). 



naried 



Ih 



BOX 
LID 
BOL 



Fuiictio IS 



ij? no 
ator 



upper ai 



EL 



EH 

(+ ('•I 



e plan data-base is initialized and then the named physical quantities are 
e entries POS and UNC simply declare the postfixes to be used in generating 
e names, so that internal data structures can more easily be debugged. The 
ry defines the type of each named physical quantities (another example might 



P 'js 



of four coupled plans 
PLAN-DATA-BASE) 
ical quantitites 



POSITION POS UNC) 
POSITION POS UNC) 
POSITION POS UNC) 



are then defined to specify the uncertainty behavior of the manipulator, 
specific model of the manipulator used by the plan checker at this level. The 
behavior is encoded in the sets of constraints Cg. 

d lower bounds on manipulator uncertainty 



X) 



0.0002216 X) -0.043262) (+ (* 0.0009857 X) -0.063329))) 



K) 



-0.0002253 X) 0.043262) (+ (* -0.0009895 X) 0.063329))) 



errcj- characteristics of the sensor are defined, and then a model of the sensor itself 
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is giv^fl. Tl e model is in terms of its error characteristics and the type of named physical 
quantlfcies v hich it can measure. 



; ; ; s<}tisor 

(FUNDI- F LS 
(FUNDI- F RS 

(DEFSm^SOR 



^• 



IlIlT 



NPQ- 

entry 

introd|ij| 
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used 
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the 



(DEFPlAn PL 



(DEFPIAN 
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samfl 



coiistrai it 



check] lig pr )cess 



sensinE] opei at 



p] in de tinitions 



PL 
NP 
AB 



and bounds on its errors. 

(X) (* -0.0004 X)) 
(X) (* 0.0004 X)) 

CAMERA LS RS '(POSITION)) 



e four plans are defined. There are up to four slots defined for each plan. 

a list of named physical quantities which describe the state of the world at 

plan. NPQ-ADDED-DEFS is a list of pairs describing named physical quantities 

nto the world state by the action of the plan. The first element of each pair is 

the new quantity and the second is an expression whose nominal value will be 

inal value for the introduced quantity. Thus in plan A the lid is to be placed 

nominal place as the box. The slots ABSTRACT-CA and ABSTRACT-CG describe 

sets C/i and Cg in terms of the named physical quantities. During the plan 

s they will be expanded in terms of plan and uncertainty variables. As 

ions get introduced, those expansions will change. 



n( mm 



^NA 



NP i-INIT ' (BOX-POSITION) 

NP i-ADDED-DEFS '((LID-POSITION BOX-POSITION)) 
AB5TRACT~CA '((IN (NOMINAL LID-POSITION) 12.0 36.0)) 
ABfTRACT~CG '((IN (UNCERTAINTY LID-POSITION) 
(EL (NOMINAL LID-POSITION)) 
(EH (NOMINAL LID-POSITION))))) 



INB 

l-INIT '(BOX-POSITION LID-POSITION) 

JTRACT-CA '((IN (- BOX-POSITION LID-POSITION) -1.0 1.0))) 
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(DEFP^jfN PIIANC 

m Q-INIT ' (BOX-POSITION LID-POSITION) 
NF Q-ADDED-DEFS '((BOLT-POSITION LID-POSITION)) 
AESTRACT-CA '((IN (NOMINAL BOLT-PUSITION) 12.0 36.0)) 
aJsTRACT-CG '((IN (UNCERTAINTY BOLT-POSITION) 
(EL (NOMINAL BOLT-POSITION)) 
(EH (NOMINAL BOLT-POSITION))))) 



(DEFPl-AN PI AND 



Thes 

real 

the 



iti<!S 



nally 

it NPl 

s in 

iisibk 



p()!5 



i:] itia! 



(INITIALIZl 



Q-INIT '(BOX-POSITION LID-POSITION BOLT-POSITION) 

STRACT-CA '((IN (- BOLT-POSITION LID-POSITION) 

(J? -7. 64.) 

(« 7. 64.)) 

(IN (- LID-POSITION BOX-POSITION) 

. (» -3. 64.) 

(55 3. 64.)))) 



. the initial state of the world is specified, and plan A is appropriately initialized. 
-LIST is filled with a list of named physical quantities corresponding to physical 
he world's initial state, while ABSTRACT-CS is a list of constraints which describe 
initial states of the world. 

state of the world 

-PLAN PLANA 

NPQ-LIST '(BOX-POSITION) 

ABSTRACT-CS '((IN (NOMINAL BOX-POSITION) 12.0 36.0) 
(IN (UNCERTAINTY BOX-POSITION) 
(EL (NOMINAL BOX-POSITION)) 
(EH (NOMINAL BOX-POSITION))))) 
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